From b2b2f97377a4b8fe5e18671b0e5126938fc405df Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Thu, 12 Nov 2026 23:04:33 +0000
Subject: [PATCH] chore(deps): update all digest updates

---
 Dockerfile                                                      | 2 +-
 .../integration/glpi/docker-compose.yml                         | 2 +-
 .../permissionsync-auth/integration/keycloak/docker-compose.yml | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 52788ad..26ba351 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -32,7 +32,7 @@ RUN cargo build --release --locked --bin permissionsync
 # The runtime base provides glibc, libgcc, OpenSSL 3, zlib, and the system
 # trust store that the native-tls/OpenSSL stack this binary links against
 # needs. It contains no shell, package manager, compiler, or Cargo state.
-FROM gcr.io/distroless/cc-debian13:nonroot@sha256:cc66d222f0a7ec996b78a99fe76a969bc80b539a5016ad866c14d1949bc6d0ab AS runtime
+FROM gcr.io/distroless/cc-debian13:nonroot@sha256:cb87acc574abe719b6e5c547384defa2f7b1f24af9605d3f618cf852495d8be2 AS runtime
 
 # Only statically true metadata. Version, revision, and creation metadata come
 # from the publishing workflow, so a local build claims no release identity.
diff --git a/crates/permissionsync-adapter-glpi/integration/glpi/docker-compose.yml b/crates/permissionsync-adapter-glpi/integration/glpi/docker-compose.yml
index 57c4a11..ff81373 100644
--- a/crates/permissionsync-adapter-glpi/integration/glpi/docker-compose.yml
+++ b/crates/permissionsync-adapter-glpi/integration/glpi/docker-compose.yml
@@ -1,6 +1,6 @@
 services:
   db:
-    image: mariadb:13.0.2@sha256:f4054da26e3a9dd6c8b5cc97363e544408b15c0fb369d7359c25dc04826eb6e1
+    image: mariadb:13.0.2@sha256:54f493ea0d60b621a5bff84e5b20100f8b86b6efa6b79158e04756c5194a5e4d
     environment:
       MARIADB_ROOT_PASSWORD: ${GLPI_TEST_DB_ROOT_PASSWORD:?db root password required}
       MARIADB_DATABASE: glpi
diff --git a/crates/permissionsync-auth/integration/keycloak/docker-compose.yml b/crates/permissionsync-auth/integration/keycloak/docker-compose.yml
index a67bc30..7c01deb 100644
--- a/crates/permissionsync-auth/integration/keycloak/docker-compose.yml
+++ b/crates/permissionsync-auth/integration/keycloak/docker-compose.yml
@@ -6,7 +6,7 @@ services:
     # The one supported Keycloak release this repository exercises, pinned by
     # exact release tag and immutable digest. Renovate proposes both together;
     # an upgrade PR must run this contract suite before merge.
-    image: quay.io/keycloak/keycloak:26.8.2@sha256:723b1d6e254c0fc96d5cffec860c7e0744d6a3277822b865bb538cf891575e41
+    image: quay.io/keycloak/keycloak:26.8.2@sha256:c68e286cacd87b942ac1939a0a1481461109d6acd3a57dc496969a319a76bbf0
     command: ["start-dev"]
     environment:
       KC_BOOTSTRAP_ADMIN_USERNAME: ${KEYCLOAK_TEST_ADMIN_USERNAME:?admin username required}