chore(deps): update container images

[red-hat-konflux]

This PR contains the following updates:

Package	Type	Update	Change
openapitools/openapi-generator-cli	final	minor	v7.16.0 → v7.24.0
registry.access.redhat.com/hi/go (source)	final	digest	55d95d0 → eb29e56
registry.access.redhat.com/hi/go (source)	stage	digest	fe0672d → aef1550
registry.access.redhat.com/hi/nodejs (source)	final	digest	b24c3fc → 24bd0d7
registry.access.redhat.com/hi/nodejs (source)	stage	digest	63f3ae9 → 41ec046

---

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • Between 12:00 AM and 07:59 AM, only on Monday (* 0-7 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 2a5c7b8f-8e1a-465a-b1a9-8a55d9a97151

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[jsell-rh]

Amber review

Status: Complete

Verdict

Request changes (posted as a COMMENT event). This is a routine Renovate digest/version bump, but two issues need attention before merge: (1) it bumps the OpenAPI generator from v7.16.0 to v7.24.0 without regenerating the committed Go SDK, so the sdk-drift-check CI job will fail; and (2) the branch is based on stale main, which has since migrated the Go runtime images to distroless hi/static and advanced the Node.js digests, so the Docker base-image hunks are obsolete and must not be resolved in a way that reverts that migration.

Amber here. The image-digest bumps within this diff are internally consistent (every Go builder → aef1550, every Go runtime → eb29e56, no stale references left behind), so the mechanical change is clean; the risks are the generator/SDK drift and the branch being behind a base-image architecture change that already landed on main.

Findings

[Major] OpenAPI generator bumped without regenerating the committed SDK — components/api-server/Dockerfile.openapi:3
The generator is bumped v7.16.0 → v7.24.0 (8 minor versions), but the committed generated client is not regenerated. components/api-server/pkg/api/openapi/.openapi-generator/VERSION still reads 7.16.0, and make generate (rm -rf pkg/api/openapi then copy-back) rewrites that file to 7.24.0. The .github/workflows/sdk-drift-check.yml job triggers on Dockerfile.openapi changes, runs make generate generate-sdk, and fails on any diff — so this will fail CI at minimum on the VERSION file, and likely on generator output changes across 8 minor releases.
Fix: cd components/api-server && make generate generate-sdk, commit the result, and review the regenerated diff for any behavioral/shape changes in the client before merging. Confidence: High.

[Major] Branch is based on stale main; base-image hunks are obsolete and risk reverting the distroless migration — components/api-server/Dockerfile:20, components/cli/Dockerfile:13, components/control-plane/Dockerfile:20, components/web-console/Dockerfile:1,33
Current main no longer contains the lines this PR edits. On main, the Go runtime images for api-server, cli, and control-plane are registry.access.redhat.com/hi/static:1787099997@sha256:f4d5109b… (a distroless static migration), not hi/go:1.26.5, and the builder stage is a single hi/go:1.26.5@sha256:eb29e565… line (no separate -builder digest). The Node.js digests on main are already newer (…e2a04f74 builder / …07b0f6cf runtime) than both this PR's old and new values. Merging/rebasing this diff naively would revert main to hi/go runtimes and downgrade Node.js. Renovate should rebase this branch onto current main; after rebase, re-review to confirm the hi/static runtimes are preserved and only the intended digests move. Confidence: High.

[Info] Digest consistency within the diff is correct — All Go builder stages move uniformly to aef1550… and all Go runtime stages to eb29e56…; no dangling references to the old digests remain in the tree. Good hygiene on the "image references consistent across the stack" convention (as evaluated against this diff's own base).

Cross-PR coordination

I reviewed the 23 other open PRs against main. Comparing goals, ownership boundaries, data models, interfaces, and required change order:

• No material design conflict found with any open PR. The other dependency PRs are scoped to different artifacts: chore(deps): update go indirect dependencies #75 (chore(deps): update go indirect dependencies) touches only go.mod/go.sum; chore(deps): update dependency @patternfly/react-core to v6.6.1 #188/chore(deps): update dependency @patternfly/react-icons to v6.6.1 #189 (@patternfly/react-core/react-icons) and chore(deps): update dependency react-intl to v10.1.20 #135 (react-intl) touch JS package manifests, not the Node.js base-image digest. [HYPERSHELL-45] Update gateway and supervisor openshell images to Red Hat ones #201 ([HYPERSHELL-45] Red Hat OpenShell images) changes the gateway/supervisor runtime images, not these builder/runtime base images — a disjoint concern.
• File overlap without design conflict: feat(control-plane): adopt upstream OpenShell Helm chart for gateway deployments #194 (control-plane Helm adoption), HYPERSHELL-112 Dashboard UI #209 and Hypershell-154 UI with adjustments #214 (dashboard UI) edit components/control-plane/Dockerfile / components/web-console/Dockerfile, but those are additive changes on the current-main Dockerfile structure. Because this PR is stale (see Major finding above) and must be rebased, the overlap is an ordinary rebase concern, not a competing design or interface change. I am not reporting these as conflicts on file overlap alone.
• One change-order coordination point (non-blocking): spec(control-plane): gate gateway re-provisioning on desired-state convergence #151 (spec(control-plane): gate gateway re-provisioning…) carries regenerated OpenAPI SDK output (components/api-server/pkg/api/openapi/...) produced by the current (v7.16.0) generator. Because this PR changes the generator version itself, whichever of chore(deps): update container images #73 and spec(control-plane): gate gateway re-provisioning on desired-state convergence #151 merges second will need its committed SDK regenerated against the then-active generator so the sdk-drift-check passes. Maintainers should decide the merge order (recommend merging chore(deps): update container images #73 with a regenerated SDK first, then rebasing/regenerating spec(control-plane): gate gateway re-provisioning on desired-state convergence #151) rather than letting both land with mismatched generator output. This is coordination, not a design conflict.

Findings Summary (highest severity first)

1. [Major] OpenAPI generator bumped to v7.24.0 without regenerating the committed SDK; sdk-drift-check will fail - Convention: OpenAPI client via make generate only (Dockerfile.openapi:3)
2. [Major] Branch based on stale main; base-image hunks are obsolete and risk reverting the hi/static distroless migration / downgrading Node.js - Architecture / release order (Dockerfile:20, web-console/Dockerfile:1,33)
3. [Info] In-diff image digest consistency is correct; no stale references remain - Image consistency

Convention Checklist

Convention	Result
OpenAPI client regenerated via make generate (not stale)	Fail
Image references consistent across the stack (within diff base)	Pass
Image references consistent with current main	Fail (stale base)
Conventional commit message	Pass

[jsell-rh]

Verdict

Request changes (posted as a COMMENT event). This is a routine Renovate digest/version bump, but two issues need attention before merge: (1) it bumps the OpenAPI generator from v7.16.0 to v7.24.0 without regenerating the committed Go SDK, so the sdk-drift-check CI job will fail; and (2) the branch is based on stale main, which has since migrated the Go runtime images to distroless hi/static and advanced the Node.js digests, so the Docker base-image hunks are obsolete and must not be resolved in a way that reverts that migration.

Amber here. The image-digest bumps within this diff are internally consistent (every Go builder → aef1550, every Go runtime → eb29e56, no stale references left behind), so the mechanical change is clean; the risks are the generator/SDK drift and the branch being behind a base-image architecture change that already landed on main.

Findings

[Major] OpenAPI generator bumped without regenerating the committed SDK — components/api-server/Dockerfile.openapi:3
The generator is bumped v7.16.0 → v7.24.0 (8 minor versions), but the committed generated client is not regenerated. components/api-server/pkg/api/openapi/.openapi-generator/VERSION still reads 7.16.0, and make generate (rm -rf pkg/api/openapi then copy-back) rewrites that file to 7.24.0. The .github/workflows/sdk-drift-check.yml job triggers on Dockerfile.openapi changes, runs make generate generate-sdk, and fails on any diff — so this will fail CI at minimum on the VERSION file, and likely on generator output changes across 8 minor releases.
Fix: cd components/api-server && make generate generate-sdk, commit the result, and review the regenerated diff for any behavioral/shape changes in the client before merging. Confidence: High.

[Major] Branch is based on stale main; base-image hunks are obsolete and risk reverting the distroless migration — components/api-server/Dockerfile:20, components/cli/Dockerfile:13, components/control-plane/Dockerfile:20, components/web-console/Dockerfile:1,33
Current main no longer contains the lines this PR edits. On main, the Go runtime images for api-server, cli, and control-plane are registry.access.redhat.com/hi/static:1787099997@sha256:f4d5109b… (a distroless static migration), not hi/go:1.26.5, and the builder stage is a single hi/go:1.26.5@sha256:eb29e565… line (no separate -builder digest). The Node.js digests on main are already newer (…e2a04f74 builder / …07b0f6cf runtime) than both this PR's old and new values. Merging/rebasing this diff naively would revert main to hi/go runtimes and downgrade Node.js. Renovate should rebase this branch onto current main; after rebase, re-review to confirm the hi/static runtimes are preserved and only the intended digests move. Confidence: High.

[Info] Digest consistency within the diff is correct — All Go builder stages move uniformly to aef1550… and all Go runtime stages to eb29e56…; no dangling references to the old digests remain in the tree. Good hygiene on the "image references consistent across the stack" convention (as evaluated against this diff's own base).

Cross-PR coordination

I reviewed the 23 other open PRs against main. Comparing goals, ownership boundaries, data models, interfaces, and required change order:

• No material design conflict found with any open PR. The other dependency PRs are scoped to different artifacts: #75 (chore(deps): update go indirect dependencies) touches only go.mod/go.sum; #188/#189 (@patternfly/react-core/react-icons) and #135 (react-intl) touch JS package manifests, not the Node.js base-image digest. #201 ([HYPERSHELL-45] Red Hat OpenShell images) changes the gateway/supervisor runtime images, not these builder/runtime base images — a disjoint concern.
• File overlap without design conflict: #194 (control-plane Helm adoption), #209 and #214 (dashboard UI) edit components/control-plane/Dockerfile / components/web-console/Dockerfile, but those are additive changes on the current-main Dockerfile structure. Because this PR is stale (see Major finding above) and must be rebased, the overlap is an ordinary rebase concern, not a competing design or interface change. I am not reporting these as conflicts on file overlap alone.
• One change-order coordination point (non-blocking): #151 (spec(control-plane): gate gateway re-provisioning…) carries regenerated OpenAPI SDK output (components/api-server/pkg/api/openapi/...) produced by the current (v7.16.0) generator. Because this PR changes the generator version itself, whichever of #73 and #151 merges second will need its committed SDK regenerated against the then-active generator so the sdk-drift-check passes. Maintainers should decide the merge order (recommend merging #73 with a regenerated SDK first, then rebasing/regenerating #151) rather than letting both land with mismatched generator output. This is coordination, not a design conflict.

Findings Summary (highest severity first)

1. [Major] OpenAPI generator bumped to v7.24.0 without regenerating the committed SDK; sdk-drift-check will fail - Convention: OpenAPI client via make generate only (Dockerfile.openapi:3)
2. [Major] Branch based on stale main; base-image hunks are obsolete and risk reverting the hi/static distroless migration / downgrading Node.js - Architecture / release order (Dockerfile:20, web-console/Dockerfile:1,33)
3. [Info] In-diff image digest consistency is correct; no stale references remain - Image consistency

Convention Checklist

Convention	Result
OpenAPI client regenerated via make generate (not stale)	Fail
Image references consistent across the stack (within diff base)	Pass
Image references consistent with current main	Fail (stale base)
Conventional commit message	Pass

[jsell-rh]

[Major] Regenerate the committed SDK for this generator bump. Bumping openapi-generator-cli v7.16.0 -> v7.24.0 changes the tool that produces components/api-server/pkg/api/openapi. That directory's .openapi-generator/VERSION still says 7.16.0, and make generate (which rm -rf pkg/api/openapi then copies the container output back) will rewrite it to 7.24.0. .github/workflows/sdk-drift-check.yml runs make generate generate-sdk on any Dockerfile.openapi change and fails on drift, so this bump will fail CI until the SDK is regenerated. Run cd components/api-server && make generate generate-sdk, commit, and review the regenerated diff for behavioral changes before merge.

[jsell-rh]

[Major] This line no longer exists on main. Current main uses registry.access.redhat.com/hi/static:1787099997@sha256:f4d5109b... (distroless static) for the control-plane runtime, not hi/go:1.26.5. This branch is based on stale main, so this hunk is obsolete; if resolved naively during rebase it would revert the hi/static migration. Rebase onto current main and re-review to confirm the distroless runtime is preserved.

[jsell-rh]

[Major] Stale digest relative to main. main already pins the Node.js runtime at sha256:07b0f6cf... (and the builder at sha256:e2a04f74...), both newer than the value this PR sets. Merging this hunk would downgrade Node.js. Rebase onto current main so Renovate re-derives the correct digests.