Update docker images

.github/workflows/e2e-tests.yml

@@ -163,7 +163,7 @@ jobs:
           fi
           # Envoy is only used by the network-isolation test suite
           if [ "${{ matrix.title }}" = "network-isolation" ]; then
-            images="$images envoyproxy/envoy:distroless-v1.39.1@sha256:eb2c01c13125d1629637cb4e4cce7207009fb7cc2c8027f9742758549d15b6f4 python:3.15-slim@sha256:2da676046630d7bf14c6764ae1143dc7fa0377a53f94bf5a642f0b214aca5bce"
+            images="$images envoyproxy/envoy:distroless-v1.39.1@sha256:eb2c01c13125d1629637cb4e4cce7207009fb7cc2c8027f9742758549d15b6f4 python:3.15-slim@sha256:533b0b2f9b5d46fd097091cf826f27902f1d6c3bca714b6dc74551356aa97a51"
           fi
 
           for server in $servers; do

.github/workflows/skills-keyless-signing-e2e.yml

@@ -64,7 +64,7 @@ jobs:
       # Throwaway registry. Nothing published here outlives the job, so it
       # runs over plain HTTP with no auth.
       registry:
-        image: registry:3@sha256:ddf754342cfc8acc51a56d5d0ab6af06826461864460636d8bd5c546dab2a7b8
+        image: registry:3@sha256:01cd312e67026f06f5d89c3e133a4a9adc7cb9eeb9b1194e0b2954dfd770efd2
         ports:
           - 5000:5000
 

cmd/thv/app/inspector/version.go

@@ -7,4 +7,4 @@ package inspector
 // Image specifies the image to use for the inspector command.
 // TODO: This could probably be a flag with a sensible default
 // Pinning to a specific version for stability.
-var Image = "ghcr.io/modelcontextprotocol/inspector:2.11.0"
+var Image = "ghcr.io/modelcontextprotocol/inspector:2.12.0"

containers/egress-proxy/Dockerfile

@@ -1,5 +1,5 @@
 # Use Alpine Linux 3.22.0 for minimal footprint
-FROM alpine:3.24.2
+FROM alpine:3.24.3
 
 # Install squid from edge repository and create necessary directories
 RUN echo "https://dl-cdn.alpinelinux.org/alpine/edge/community" >> /etc/apk/repositories \

pkg/container/templates/go.tmpl

@@ -74,7 +74,7 @@ RUN package="{{.MCPPackage}}"; \
 {{end}}
 
 # Final stage - minimal runtime image
-FROM index.docker.io/library/alpine:3.24@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6
+FROM index.docker.io/library/alpine:3.24@sha256:be2656061b536c1883c4034790e21d0a09c5aaaf51968b89368a3c0371ea2c9a
 
 {{if .RuntimeConfig.RuntimeEnv}}
 # Custom runtime environment variables

test/e2e/images/images.go

@@ -42,7 +42,7 @@ const (
 	// in Kubernetes tests. These run Flask-based Python services for testing authentication flows.
 	PythonImage = pythonImageURL + ":" + pythonImageTag
 
-	networkFixtureImageDigest = "sha256:2da676046630d7bf14c6764ae1143dc7fa0377a53f94bf5a642f0b214aca5bce"
+	networkFixtureImageDigest = "sha256:533b0b2f9b5d46fd097091cf826f27902f1d6c3bca714b6dc74551356aa97a51"
 	// NetworkFixtureImage is pinned because network-isolation tests use it for
 	// security-sensitive DNS and HTTP fixtures in the Docker-backed CI shard.
 	NetworkFixtureImage = pythonImageURL + ":" + pythonImageTag + "@" + networkFixtureImageDigest