[dependabot]

Bumps golang from 0525c95 to 3441473.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[claude]

Claude finished @dependabot[bot]'s task in 31s —— View job

---

Builder image: what changed

	base	PR
Alpine	3.23.7	3.23.7
Go	go1.26.10	go1.26.10

Package changes

Review: golang builder digest bump (0525c95 → 3441473)

What changed: One line in Dockerfile:10. The golang:1.26.10-alpine3.23 digest is updated and the tag stays the same.

What's inside: The measured comparison above shows the same Alpine release (3.23.7), the same Go toolchain (go1.26.10), and an identical package list. All 17 base packages match exactly, including libssl3/libcrypto3 3.5.9-r0, musl 1.2.5-r24, busybox 1.37.0-r30 and ca-certificates 20261020-r0. The package diff is empty, so this looks like an upstream rebuild or republish of the same tag rather than a content change.

Effect on this repo:

• The image is only used as the builder stage. The final image is FROM scratch and copies just the static kosli binary (CGO_ENABLED=0) and /etc/ssl/certs/ca-certificates.crt out of it.
• With the same Go version and the same ca-certificates package, neither the compiled binary nor the shipped CA bundle should differ in any meaningful way.
• apk add git bash make ca-certificates runs at build time and pulls from the Alpine 3.23 repo whatever the digest is, so this bump doesn't change that step.
• GOTOOLCHAIN=auto still behaves the same, because the go directive in go.mod decides whether a newer toolchain is downloaded, and the base Go version hasn't moved.

Risks: None found. There are no breaking changes, deprecations or behaviour changes to call out.

Suggested checks: Confirm the Docker image build passes in CI before merging. No other follow-up is needed.

✅ Safe to merge once CI passes.