From d5b72dc6389944971c8a6a7340402bddfe583c3d Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 17 Aug 2026 03:15:53 +0000
Subject: [PATCH 1/2] chore(deps): bump python in the docker-base-images group

Bumps the docker-base-images group with 1 update: python.


Updates `python` from `a7fb1e6` to `ce40764`

---
updated-dependencies:
- dependency-name: python
  dependency-version: 3.14-slim
  dependency-type: direct:production
  dependency-group: docker-base-images
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Dockerfile b/Dockerfile
index 68c5d2e91..10a97258b 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,5 +1,5 @@
 # Stage 1: Backend runtime for local Compose and backend-only deployments
-FROM python:3.14-slim@sha256:a7fb1e634c4a578f9e0bd6327f11a3cde11b7a9395f48e24360c0988bcc5c2bc AS backend-runtime
+FROM python:3.14-slim@sha256:ce40764625a4ff50df3548277632e7f96c4e77fe75fa848aae9885476e7df5a4 AS backend-runtime
 WORKDIR /app
 
 ENV PYTHONDONTWRITEBYTECODE=1

From 2df62d87373f917d0dd1f6702c66d8c1a1b97c3b Mon Sep 17 00:00:00 2001
From: Cursor Agent <cursoragent@cursor.com>
Date: Mon, 17 Aug 2026 15:49:44 +0000
Subject: [PATCH 2/2] fix(docker): sync python 3.14-slim digest across OCI
 metadata and connector

Dependabot updated only the root Dockerfile FROM pin. Release-governance
tests require the connector image and OCI base digest/name defaults to
describe the same first-stage digest.

Co-authored-by: seonghobae <seonghobae@me.com>
---
 CHANGELOG.md         | 1 +
 Dockerfile           | 4 ++--
 connector/Dockerfile | 2 +-
 3 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 23ef6f82a..08d428689 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,4 +1,5 @@
 ## [Unreleased]
+- `python:3.14-slim` digest `ce40764625a4ff50df3548277632e7f96c4e77fe75fa848aae9885476e7df5a4`를 root `FROM`, connector `FROM`, 그리고 OCI `base.digest`/`base.name` 기본 ARG에 동기화해 Dependabot가 root Dockerfile만 갱신한 뒤 남기던 provenance drift를 제거합니다.
 - EmailDetail 테스트가 지원하지 않는 스레드 병합/분리 버튼을 `textContent`뿐 아니라 `aria-label`과 `title` 접근 가능 이름으로도 검출하도록 바꿔, 아이콘 전용 버튼 회귀를 놓치지 않습니다.
 ### 주제 측정 경계 (Topic Measurement)
 
diff --git a/Dockerfile b/Dockerfile
index 10a97258b..c72242e7c 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -63,8 +63,8 @@ ARG OCI_IMAGE_LICENSES="LicenseRef-Naruon-Proprietary"
 ARG OCI_IMAGE_REF_NAME=""
 ARG OCI_IMAGE_TITLE="naruon"
 ARG OCI_IMAGE_DESCRIPTION="Naruon combined FastAPI and Next.js runtime image"
-ARG OCI_IMAGE_BASE_DIGEST="sha256:a7fb1e634c4a578f9e0bd6327f11a3cde11b7a9395f48e24360c0988bcc5c2bc"
-ARG OCI_IMAGE_BASE_NAME="docker.io/library/python:3.14-slim@sha256:a7fb1e634c4a578f9e0bd6327f11a3cde11b7a9395f48e24360c0988bcc5c2bc"
+ARG OCI_IMAGE_BASE_DIGEST="sha256:ce40764625a4ff50df3548277632e7f96c4e77fe75fa848aae9885476e7df5a4"
+ARG OCI_IMAGE_BASE_NAME="docker.io/library/python:3.14-slim@sha256:ce40764625a4ff50df3548277632e7f96c4e77fe75fa848aae9885476e7df5a4"
 
 # Defaults keep local builds provenance-complete. The publishing workflow derives
 # and overrides both values from the exact first FROM instruction, while
diff --git a/connector/Dockerfile b/connector/Dockerfile
index fa45883d0..13a8a9c4c 100644
--- a/connector/Dockerfile
+++ b/connector/Dockerfile
@@ -1,4 +1,4 @@
-FROM python:3.14-slim@sha256:a7fb1e634c4a578f9e0bd6327f11a3cde11b7a9395f48e24360c0988bcc5c2bc
+FROM python:3.14-slim@sha256:ce40764625a4ff50df3548277632e7f96c4e77fe75fa848aae9885476e7df5a4
 
 WORKDIR /app
 ENV PYTHONDONTWRITEBYTECODE=1