chore(deps): update docker.io/library/postgres docker tag to v18

[renovate-bot-cbcoutinho]

This PR contains the following updates:

Package	Update	Change
docker.io/library/postgres (source)	major	16-alpine → 18-alpine

---

Configuration

📅 Schedule: (in timezone Europe/Amsterdam)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[claude]

Claude finished @renovate-bot-cbcoutinho[bot]'s task in 1m 10s —— View job

---

PR Review

• Gather context
• Review docker-compose.yml change
• Assess PostgreSQL 18 compatibility
• Post final review

---

Summary

This PR updates the postgres-test Docker Compose service from postgres:16-alpine to postgres:18-alpine — a major version bump generated by Renovate.

---

Findings

Scope is well-contained. The change affects only the postgres-test service, which is gated behind --profile postgres (see docker-compose.yml:410). The default compose stack and CI runs without this profile are not impacted.

SHA digest pinning is preserved. The new tag includes a pinned digest (@sha256:1b1689b...), which is the correct pattern for reproducible and tamper-evident builds.

Major version skip (16 → 18) is safe here. Because this is a clean test container with no persistent data, there is no schema migration risk. Postgres 17 can be skipped without issue.

Client library compatibility looks fine. The application declares:

• asyncpg>=0.29 — asyncpg has supported Postgres 18 since 0.30.x
• procrastinate>=3.8 + psycopg[binary,pool]>=3.2 — both are modern enough to support Postgres 18

Healthcheck is version-agnostic. pg_isready -U mcp -d mcp works across all Postgres versions.

No code changes needed. The postgresql+asyncpg:// URL in TEST_DATABASE_URL and Alembic migrations work against any supported Postgres version.

---

Verdict

No issues found. This is a clean, well-scoped dependency bump. The postgres-test service is an opt-in development/testing convenience, the image is SHA-pinned, and all client libraries support Postgres 18. Safe to merge.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud