chore(deps): update python:3.14.0-alpine3.21 docker digest to a9bf2b3

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
python	final	digest	c2410fb -> a9bf2b3

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[claude]

Pull Request Review

Summary

This PR updates the Python base image digest from c2410fb to a9bf2b3 for the python:3.14.0-alpine3.21 image across three Dockerfiles. This is an automated dependency update from Renovate.

Code Quality ✅

• Clean and focused: Changes are minimal and targeted, updating only the SHA256 digest
• Consistent: All three Dockerfiles are updated uniformly
• Pinned versions: The PR maintains the excellent practice of pinning both the image tag (3.14.0-alpine3.21) and digest for reproducibility

Security 🔒

• Digest pinning: The use of SHA256 digests provides strong security guarantees by ensuring the exact image is used, preventing tag mutation attacks
• Minimal attack surface: Alpine Linux base image is a good choice for minimal attack surface
• Dependency updates: Regular digest updates like this help ensure security patches are applied

Best Practices ✅

• Infrastructure as Code: Dockerfiles are properly versioned in CI directory
• DRY concern: Minor observation - the three Dockerfiles have similar structure. Consider if a multi-stage build or shared base image could reduce duplication in the future (not blocking for this PR)

Testing Considerations

• The PR will trigger CI workflows including:
  • continuous-integration.yml
  • dogfood.yml
  • conventional-commits.yml
• These should validate that the new base image works correctly with all existing functionality

Recommendation

✅ APPROVE - This is a straightforward dependency update that:

• Maintains security best practices with digest pinning
• Updates all affected files consistently
• Is automatically generated by Renovate with automerge enabled
• Should be safe to merge once CI passes

Minor Suggestions (Future Enhancements)

1. Consider documenting why specific Alpine package versions are pinned (e.g., py3-autopep8=2.1.0-r1, git=2.47.3-r0)
2. Consider consolidating similar Dockerfiles if maintenance becomes an issue

Great work maintaining up-to-date and secure dependencies!