chore(docker): update docker digests

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
docker.io/alpine	final	digest	bec4ccd → 28bd5fe
docker.io/alpine	stage	digest	bec4ccd → 28bd5fe
docker.io/golang	stage	digest	c05ba4b → ba6ba81

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[DeepDiver1975]

🤖 Automated review by Claude Code review agent.

Overview

Renovate bot digest-pin update for v8/Dockerfile.multiarch. It bumps the pinned digest for docker.io/alpine:3.24.1 from bec4ccd... to 28bd5fe... in both the node-builder stage and the final stage. Net change: +2/-2 on a single file. The image tag (3.24.1) is unchanged — only the immutable digest is updated to track the latest rebuild of that tag.

Code quality / style

• Both occurrences are updated consistently to the same new digest, keeping the build and final stages aligned. Good — a mismatch here would be the main thing to flag.
• Digests are well-formed sha256: hex strings of the correct length (64 hex chars).
• No unexpected files touched; scope matches the stated intent.

Specific suggestions

• None. The change is mechanical and correct.

Potential issues / risks

• Low risk. The underlying tag and base image are unchanged; this only re-pins to the current digest of alpine:3.24.1.
• As with any base-image bump, CI building the image is the real validation that the new layer behaves identically. Renovate has automerge enabled for this PR, so passing CI is the gate.

LGTM — low-risk automated digest update.

[DeepDiver1975]

🤖 Automated review by Claude Code review agent.

Renovate Docker digest pin update — looks clean.

Change scope: digest-only. Both FROM docker.io/alpine:3.24.1@sha256:... lines in v8/Dockerfile.multiarch (the node-builder stage and the final stage) move from bec4ccd... to 28bd5fe.... The tag (3.24.1) and image are unchanged — no version/major bump. The new digest is a well-formed 64-char sha256 pin.

Checks: ⚠️ Multiple build matrix jobs are failing (arm64/amd64 across the 8.0.4 and 8.1.0-rc.1 variants); mergeStateStatus=UNSTABLE. However, master branch protection defines no required status checks (it only requires 1 review, code-owner review, and signed commits), so these failures are not merge-blocking by configuration. The failures appear to be matrix/build-environment issues rather than anything introduced by this digest change, but they should be looked at before relying on these images.

Verdict: The diff itself is correct and low-risk (pure digest re-pin to the current alpine:3.24.1). Approve-with-nits — flagging the red build jobs for human awareness even though they aren't required checks.