From fa071821a045c47b3497cd3c8a4d38beb26c612c Mon Sep 17 00:00:00 2001
From: Antoine Toussaint
 <312536060+antoinetoussaint-byte@users.noreply.github.com>
Date: Wed, 28 Oct 2026 19:22:01 -0400
Subject: [PATCH] fix(bootstrap): refresh Alpine base for patched OS packages

---
 bootstrap-image.json      |  4 ++--
 docs/bootstrap-migrate.md | 10 ++++++++++
 2 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/bootstrap-image.json b/bootstrap-image.json
index 2e61bab..0134ea7 100644
--- a/bootstrap-image.json
+++ b/bootstrap-image.json
@@ -1,8 +1,8 @@
 {
   "base": {
     "image": "alpine",
-    "version": "3.21.8",
-    "digest": "sha256:ce64758a109eb420d874a118f87920e625e12d3634e03b4a5573fd9f6e5d3507"
+    "version": "3.21.9",
+    "digest": "sha256:ee16d92f96db08d9d2d07da48555a27f3a69d8f0759021dbc601195ed0d2b5bd"
   },
   "packages": {
     "repositories": [
diff --git a/docs/bootstrap-migrate.md b/docs/bootstrap-migrate.md
index c660b86..abe3bf4 100644
--- a/docs/bootstrap-migrate.md
+++ b/docs/bootstrap-migrate.md
@@ -31,6 +31,16 @@ provenance. Normal context hashing includes the staged source files. The build
 copies only the compiled executable and cleaned bootstrap artifacts into the
 runtime, so an SBOM describes shipped code rather than unused parent manifests.
 
+The bootstrap OS is maintained separately from the migrate executable and the
+PostgreSQL server image in `runtime-image.json`. The Alpine 3.21.9 bootstrap base
+updates libcrypto3/libssl3 to 3.3.7-r2, musl/musl-utils to 1.2.5-r12 and zlib to
+1.3.2-r1 on both architectures, addressing the fixable OS findings in the prior
+3.21.8 base. This stays on the same Alpine branch and PostgreSQL 17 client. Resolve
+the base with the full lock updater; do not add an unpinned `apk upgrade` to
+consumer Dockerfiles. Rebuilding with an older agent retains its embedded lock,
+so consumers must select the corrected source artifact or subsequent release.
+Package inspection of the base is not a scan of the final migration images.
+
 Use `.github/scripts/update-bootstrap-migrate.py` to resolve the migrate portion
 of the lock without Docker. It reads migrate's version from `go.mod`, retains the
 existing exact compiler tag, verifies the registry manifest digest and checks