chore(release): pending release v0.46.0

.github/renovate.json5

@@ -41,6 +41,18 @@
   packageRules: [
     {matchFileNames: ['.github/workflows/**'], semanticCommitType: 'ci'},
     {matchDatasources: ['docker'], semanticCommitType: 'build'},
+    {
+      // versioning: node + versionCompatibility split "24.16.0-alpine" into
+      // version=24.16.0 / compatibility=-alpine so Renovate compares Node semver
+      // and rebuilds the tag on upgrades. sourceUrl inlines release-note
+      // summaries from nodejs/node into the PR body.
+      matchDatasources: ['docker'],
+      matchPackageNames: ['/(?:^|/)node$/'],
+      versioning: 'node',
+      versionCompatibility: '^(?<version>[^-]+)(?<compatibility>-.*)?$',
+      sourceUrl: 'https://github.com/nodejs/node',
+      commitMessageTopic: 'Node.js',
+    },
     {
       matchPackageNames: [
         '@bfra.me/tsconfig',

.github/workflows/renovate.yaml

@@ -52,7 +52,7 @@ jobs:
     secrets:
       APPLICATION_ID: ${{ secrets.APPLICATION_ID }}
       APPLICATION_PRIVATE_KEY: ${{ secrets.APPLICATION_PRIVATE_KEY }}
-    uses: bfra-me/.github/.github/workflows/renovate.yaml@f055576cb64541acf07ebc38b12020bcda35d7e5 # v4.16.18
+    uses: bfra-me/.github/.github/workflows/renovate.yaml@165ed192e9969365ec079b36e3f42a443bb75647 # v4.16.21
     with:
       log-level: ${{ inputs.log-level || 'debug' }}
       print-config: ${{ inputs.print-config || false }}

.github/workflows/update-repo-settings.yaml

@@ -18,4 +18,4 @@ jobs:
     secrets:
       APPLICATION_ID: ${{ secrets.APPLICATION_ID }}
       APPLICATION_PRIVATE_KEY: ${{ secrets.APPLICATION_PRIVATE_KEY }}
-    uses: bfra-me/.github/.github/workflows/update-repo-settings.yaml@f055576cb64541acf07ebc38b12020bcda35d7e5 # v4.16.18
+    uses: bfra-me/.github/.github/workflows/update-repo-settings.yaml@165ed192e9969365ec079b36e3f42a443bb75647 # v4.16.21

apps/workspace-agent/package.json

@@ -14,7 +14,7 @@
   },
   "dependencies": {
     "@hono/node-server": "1.19.14",
-    "hono": "4.12.22"
+    "hono": "4.12.23"
   },
   "devDependencies": {
     "vitest": "4.1.6"

deploy/gateway.Dockerfile

@@ -1,7 +1,7 @@
 # syntax=docker/dockerfile:1@sha256:87999aa3d42bdc6bea60565083ee17e86d1f3339802f543c0d03998580f9cb89
 
 # ── Stage 1: build ────────────────────────────────────────────────────────────
-FROM node:24-alpine@sha256:d1b3b4da11eefd5941e7f0b9cf17783fc99d9c6fc34884a665f40a06dbdfc94f AS build
+FROM node:24.16.0-alpine@sha256:2bdb65ed1dab192432bc31c95f94155ca5ad7fc1392fb7eb7526ab682fa5bf14 AS build
 
 WORKDIR /workspace
 
@@ -25,7 +25,7 @@ RUN pnpm --filter @fro-bot/runtime build
 RUN pnpm --filter @fro-bot/gateway build
 
 # ── Stage 2: runtime ──────────────────────────────────────────────────────────
-FROM node:24-alpine@sha256:d1b3b4da11eefd5941e7f0b9cf17783fc99d9c6fc34884a665f40a06dbdfc94f AS runtime
+FROM node:24.16.0-alpine@sha256:2bdb65ed1dab192432bc31c95f94155ca5ad7fc1392fb7eb7526ab682fa5bf14 AS runtime
 
 WORKDIR /app
 

deploy/workspace.Dockerfile

@@ -11,6 +11,6 @@
 #   - mitmproxy CA injected into /usr/local/share/ca-certificates/mitmproxy.crt
 #     followed by update-ca-certificates so all outbound TLS goes through the proxy
 
-FROM node:24-alpine@sha256:d1b3b4da11eefd5941e7f0b9cf17783fc99d9c6fc34884a665f40a06dbdfc94f
+FROM node:24.16.0-alpine@sha256:2bdb65ed1dab192432bc31c95f94155ca5ad7fc1392fb7eb7526ab682fa5bf14
 
 CMD ["sh", "-c", "echo 'workspace placeholder — Unit 7 will replace this'; sleep infinity"]