Update docker-compose dependencies

[renovate]

This PR contains the following updates:

Package	Update	Change
postgres (source)	digest	1b1689b → 9a8afca
temporalio/ui	minor	2.51.1 → 2.52.1

---

Release Notes

temporalio/ui-server (temporalio/ui)

v2.52.1

Compare Source

Release synced from ui@v2.52.1

Full Changelog: temporalio/ui-server@v2.52.0...v2.52.1

v2.52.0

Compare Source

Release synced from ui@v2.52.0

Full Changelog: temporalio/ui-server@v2.50.1...v2.52.0

---

Configuration

📅 Schedule: (in timezone Etc/UTC)

• Branch creation
  • "after 5pm on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[claude]

Review: postgres:18-alpine digest bump (1b1689b → 9a8afca)

Reviewed the upstream changes for this digest bump. This picks up PostgreSQL 18.4 (released May 14, 2026), which includes:

• 11 security fixes (CVSS up to 8.8), including integer wraparound in allocations, libpq stack buffer overflow, SSL/GSS recursion DoS, and refint module arbitrary code execution.
• 60+ bug fixes spanning collation handling, partition pruning, MERGE concurrency, array_agg parallel execution, logical replication slot sync stability, WAL recovery, and timezone data update to tzdata 2026b.

No breaking changes or regressions documented. No dump/restore or pg_upgrade required.

The diff only touches digest pins in docker-compose.yml and docker-compose-dev.yml — no PII/secret exposure concerns.

✅ Looks clean. Safe to merge.

[claude]

Code review

No issues found. Checked for bugs and CLAUDE.md compliance.

Upstream dependency check (per REVIEW.md)

This PR bumps the postgres:18-alpine Docker image digest (tag unchanged). The new image likely includes PostgreSQL 18.4 (released May 14, 2026), which contains:

Security fixes (6 CVEs):

• CVE-2026-6479: Unbounded recursion in startup packets
• CVE-2026-6473: Integer overflow in memory allocation (potential buffer overruns)
• CVE-2026-6476/6638/6637: SQL injection in pg_createsubscriber, logical replication, and contrib/spi
• CVE-2026-6475: Path traversal in pg_basebackup/pg_rewind
• CVE-2026-6477: PQfn() buffer overflow
• CVE-2026-6478: Timing-safe authentication comparisons
• CVE-2026-6474: Format string/buffer overflow in time zone functions

Notable bug fixes: Planner corrections, virtual generated column handling, window aggregate overflow, replication fixes, and tzdata update to 2026b.

Regression risk: Low. No dump/restore required. No breaking changes to catalog schema or SQL behavior. The security fixes are beneficial. Both docker-compose.yml and docker-compose-dev.yml are updated consistently to the same digest.

[claude]

Review: postgres:18-alpine digest bump

Reviewed the digest change 1b1689b → 9a8afca across docker-compose.yml and docker-compose-dev.yml.

Upstream changes between digests:

• Alpine 3.22 → 3.24: Incorporates security fixes including 15 OpenSSL CVEs from the June 2026 advisory.
• Entrypoint security hardening (docker-library/postgres#1412): POSTGRES_* environment variables (including POSTGRES_PASSWORD) are now unset before the final exec postgres, preventing credentials from lingering in the process environment.
• loong64 architecture added: No impact on amd64/arm64 images.
• No PostgreSQL version change: Both digests contain PostgreSQL 18.4.

Review checklist:

• ✅ No PII or secret exposure in the diff
• ✅ No regressions or breaking changes in upstream
• ✅ Security improvements only — safe to merge

[claude]

Automated Review — Dependency Bump

Reviewed the two dependency updates:

postgres:18-alpine (digest 1b1689b → 9a8afca):
This digest bump corresponds to the July 16, 2026 PostgreSQL security release, patching 12 CVEs — four rated High (CVSS 8.8) including stack buffer overflows, file overwrites, and integer-wraparound allocation issues. No breaking changes or behavioral modifications. This is a security-critical update that should be merged promptly.

temporalio/ui (2.51.1 → 2.52.1):
UI-only changes — new schedules overhaul, Nexus standalone operations support, accessibility improvements, and bug fixes. v2.52.1 patches bugs introduced in v2.52.0 (schedules defaults, Nexus API calls). No server-side behavioral changes, no breaking API changes, no security concerns. Safe upgrade.

PII/Secrets check: No logging, stdout, or credential changes — diff is limited to image references in docker-compose files.

No issues found. LGTM ✅

🤖 Generated with Claude Code