hacker-cb · Oct 17, 2026 · Oct 17, 2026 · Oct 17, 2026 · Oct 17, 2026
diff --git a/images/esp-idf/Dockerfile b/images/esp-idf/Dockerfile
@@ -2,7 +2,7 @@
 # Based on official Espressif image
 # Original: https://github.com/espressif/esp-idf/blob/master/tools/docker/Dockerfile
 
-ARG IDF_BASE_TAG=v5.5.5
+ARG IDF_BASE_TAG=v5.5.6
 
 FROM espressif/idf:${IDF_BASE_TAG}
 
@@ -32,10 +32,10 @@ LABEL dev.jethome.idf.version="${IDF_BASE_TAG}" \
 # so a version bump cannot move one without the other: `check-versions.sh` holds
 # `args` and the ARG defaults to each other, and requires the tag to *name* every
 # version it is built with. Note what that is not - it is a token-boundary match,
-# not equality, so a variant tagged `idf-v5.5.5-slim` would pass the checker while
-# this label read `idf-v5.5.5`. The label states the version the image was built
-# with; the index annotation states the tag. No such variant exists today, and
-# both answers are true ones to different questions.
+# not equality, so a variant tagged `idf-v<version>-slim` would pass the checker
+# while this label read `idf-v<version>`. The label states the version the image
+# was built with; the index annotation states the tag. No such variant exists
+# today, and both answers are true ones to different questions.
 #
 # The index annotations the manifest job writes carry the same field, and cannot
 # be inherited at all; these labels are what an image already pulled reports, and
@@ -107,7 +107,7 @@ WORKDIR /workspace
 # dev.jethome.idf.version label near the top of this file is what a consumer reads
 # instead of pulling several gigabytes, and a label is only worth reading if the
 # image cannot publish one that contradicts itself. Compared for equality against
-# what the SDK reports (`ESP-IDF v5.5.5`), so a tag naming one version while the
+# what the SDK reports (`ESP-IDF v<version>`), so a tag naming one version while the
 # base carries another fails here rather than downstream.
 #
 # The esptool line is an assertion, not a listing: `grep -E '^esptool'` would pass

diff --git a/images/esp-matter/Dockerfile b/images/esp-matter/Dockerfile
@@ -6,7 +6,7 @@
 # separator differs. CI pins the exact esp-idf image its own run produced; the
 # default below is what a local ./scripts/build.sh uses, and it also makes the
 # owner overridable instead of hardcoded, so a fork can build against its own base.
-ARG BASE_IMAGE=ghcr.io/jethome-iot/jethome-dev-esp-idf:idf-v5.5.5
+ARG BASE_IMAGE=ghcr.io/jethome-iot/jethome-dev-esp-idf:idf-v5.5.6
 # The Matter specification this image carries. Descriptive only - what actually
 # gets checked out is ESP_MATTER_REF below.
 ARG ESP_MATTER_VERSION=v1.6
@@ -26,7 +26,7 @@ ARG ESP_MATTER_REF=2c125619610b9a16bb8e92f5ebbf55111638615e
 # from images/versions.json instead - taken there from the same `base_tag` the
 # digest was resolved from, with the checker refusing a value the variant's own
 # tag does not name.
-ARG IDF_VERSION=v5.5.5
+ARG IDF_VERSION=v5.5.6
 
 FROM ${BASE_IMAGE}
 
@@ -125,8 +125,8 @@ RUN git config --system --add safe.directory /opt/esp-matter && \
 # index annotation carries this repository's commit, in full 40 hex.
 #
 # `image.version` names the whole variant - the published tag - rather than the
-# Matter specification alone, because an image built on ESP-IDF 5.4.1 and one
-# built on 5.5.5 can carry the same specification and are not the same image. The
+# Matter specification alone, because two images built on different ESP-IDF
+# releases can carry the same specification and are not the same image. The
 # specification keeps its own field beside it.
 LABEL dev.jethome.matter.ref="${ESP_MATTER_REF}" \
       dev.jethome.matter.version="${ESP_MATTER_VERSION}" \

diff --git a/images/esp-matter/README.md b/images/esp-matter/README.md
@@ -493,7 +493,7 @@ Available build arguments:
   instead of this repository's.
 - `IDF_VERSION` - the ESP-IDF version that base carries, for the
   `dev.jethome.idf.version` label. Same spelling the SDK itself reports, leading
-  `v` included (`v5.5.5`), and distinct from `ESP_MATTER_VERSION` — the two are
+  `v` included (`v<idf-version>`), and distinct from `ESP_MATTER_VERSION` — the two are
   different versions and the placeholders above keep them apart. **Pass it whenever `BASE_IMAGE` is not the
   default**: it does not follow the base, so a build on `idf-v<other>` would
   otherwise assert the default version and fail — after the SDK install, which is

diff --git a/images/versions.json b/images/versions.json
@@ -63,10 +63,10 @@
       "timeout_minutes": 60,
       "builds": [
         {
-          "tag": "idf-v5.5.5",
+          "tag": "idf-v5.5.6",
           "primary": true,
           "args": {
-            "IDF_BASE_TAG": "v5.5.5"
+            "IDF_BASE_TAG": "v5.5.6"
           }
         },
         {
@@ -88,26 +88,26 @@
       "timeout_minutes": 60,
       "builds": [
         {
-          "tag": "idf-v5.5.5-matter-v1.6",
+          "tag": "idf-v5.5.6-matter-v1.6",
           "primary": true,
-          "base_tag": "idf-v5.5.5",
+          "base_tag": "idf-v5.5.6",
           "upstream_branch": "release/v1.6",
           "args": {
             "ESP_MATTER_VERSION": "v1.6",
-            "IDF_VERSION": "v5.5.5"
+            "IDF_VERSION": "v5.5.6"
           },
           "pin": {
             "ESP_MATTER_REF": "2c125619610b9a16bb8e92f5ebbf55111638615e"
           }
         },
         {
-          "tag": "idf-v5.5.5-matter-v1.5.1",
+          "tag": "idf-v5.5.6-matter-v1.5.1",
           "primary": false,
-          "base_tag": "idf-v5.5.5",
+          "base_tag": "idf-v5.5.6",
           "upstream_branch": "release/v1.5",
           "args": {
             "ESP_MATTER_VERSION": "v1.5.1",
-            "IDF_VERSION": "v5.5.5"
+            "IDF_VERSION": "v5.5.6"
           },
           "pin": {
             "ESP_MATTER_REF": "44dfffd046f04552a87fa5ff7cf9695be486f177"