aledbf · Oct 26, 2026 · Oct 26, 2026 · Oct 26, 2026
diff --git a/e2fsprogs/apk.lock b/e2fsprogs/apk.lock
@@ -4,21 +4,21 @@ acl-static=2.3.2-r1
 alpine-baselayout-data=3.7.2-r1
 alpine-baselayout=3.7.2-r1
 alpine-keys=2.6-r0
-alpine-release=3.24.2-r0
+alpine-release=3.24.3-r0
 apk-tools=3.0.8-r0
 binutils=2.45.1-r1
-brotli-libs=1.2.0-r1
+brotli-libs=1.2.1-r0
 build-base=0.5-r4
 busybox-binsh=1.37.0-r31
 busybox=1.37.0-r31
 bzip2-dev=1.0.8-r6
 bzip2-static=1.0.8-r6
-c-ares=1.34.8-r0
-ca-certificates-bundle=20260909-r0
-curl=8.22.0-r0
-expat-dev=2.8.5-r0
-expat-static=2.8.5-r0
-expat=2.8.5-r0
+c-ares=1.34.9-r0
+ca-certificates-bundle=20261020-r0
+curl=8.23.0-r0
+expat-dev=2.9.0-r0
+expat-static=2.9.0-r0
+expat=2.9.0-r0
 file=5.47-r2
 fortify-headers=3.0.1-r2
 g++=15.2.0-r5
@@ -27,14 +27,14 @@ gmp=6.3.0-r4
 isl26=0.26-r2
 jansson=2.15.0-r0
 libapk=3.0.8-r0
-libarchive-dev=3.8.7-r0
-libarchive-static=3.8.7-r0
-libarchive=3.8.7-r0
+libarchive-dev=3.8.10-r0
+libarchive-static=3.8.10-r0
+libarchive=3.8.10-r0
 libatomic=15.2.0-r5
 libbz2=1.0.8-r6
 libcrypto3=3.5.9-r0
-libcurl=8.22.0-r0
-libexpat=2.8.5-r0
+libcurl=8.23.0-r0
+libexpat=2.9.0-r0
 libgcc-static=15.2.0-r5
 libgcc=15.2.0-r5
 libgomp=15.2.0-r5
@@ -52,9 +52,9 @@ lz4-static=1.10.0-r1
 make=4.4.1-r4
 mpc1=1.3.1-r1
 mpfr4=4.2.2-r0
-musl-dev=1.2.6-r2
-musl-utils=1.2.6-r2
-musl=1.2.6-r2
+musl-dev=1.2.6-r3
+musl-utils=1.2.6-r3
+musl=1.2.6-r3
 nghttp2-libs=1.70.0-r0
 openssl-dev=3.5.9-r0
 openssl-libs-static=3.5.9-r0

diff --git a/kernel/config-7.3-rc5-x86_64 → kernel/config-7.3-x86_64 b/kernel/config-7.3-rc5-x86_64 → kernel/config-7.3-x86_64
diff --git a/qemu/Dockerfile b/qemu/Dockerfile
@@ -85,7 +85,7 @@ ARG JOBS=8
 # configured under the old base, skipped configure, relinked, and produced a dynamically
 # linked binary from a Dockerfile that says --static on every other line. The assertion
 # below is what caught it.
-ARG QEMU_CONFIG_REV=6
+ARG QEMU_CONFIG_REV=7
 
 SHELL ["/bin/sh", "-o", "pipefail", "-c"]
 

diff --git a/qemu/apk.lock b/qemu/apk.lock
@@ -3,24 +3,24 @@ acpica=20250807-r0
 alpine-baselayout-data=3.7.2-r1
 alpine-baselayout=3.7.2-r1
 alpine-keys=2.6-r0
-alpine-release=3.24.2-r0
+alpine-release=3.24.3-r0
 apk-tools=3.0.8-r0
 bash=5.3.9-r1
 binutils=2.45.1-r1
 bison=3.8.2-r3
-brotli-libs=1.2.0-r1
+brotli-libs=1.2.1-r0
 bsd-compat-headers=0.7.2-r6
 build-base=0.5-r4
 busybox-binsh=1.37.0-r31
 busybox=1.37.0-r31
 bzip2-dev=1.0.8-r6
-c-ares=1.34.8-r0
-ca-certificates-bundle=20260909-r0
+c-ares=1.34.9-r0
+ca-certificates-bundle=20261020-r0
 coreutils-env=9.11-r0
 coreutils-fmt=9.11-r0
 coreutils-sha512sum=9.11-r0
 coreutils=9.11-r0
-curl=8.22.0-r0
+curl=8.23.0-r0
 docbook-xml=4.5-r10
 docbook-xsl-nons=1.79.2-r13
 docbook-xsl-ns=1.79.2-r13
@@ -56,12 +56,12 @@ libbz2=1.0.8-r6
 libcap-ng-dev=0.8.5-r2
 libcap-ng-static=0.8.5-r2
 libcap-ng=0.8.5-r2
-libcrypto3=3.5.8-r0
-libcurl=8.22.0-r0
+libcrypto3=3.5.9-r0
+libcurl=8.23.0-r0
 libeconf=0.8.3-r0
 libedit-dev=20260508.3.1-r1
 libedit=20260508.3.1-r1
-libexpat=2.8.5-r0
+libexpat=2.9.0-r0
 libfdisk=2.42.3-r1
 libffi-dev=3.5.2-r1
 libffi=3.5.2-r1
@@ -85,7 +85,7 @@ libseccomp-dev=2.6.1-r0
 libseccomp-static=2.6.1-r0
 libseccomp=2.6.1-r0
 libsmartcols=2.42.3-r1
-libssl3=3.5.8-r0
+libssl3=3.5.9-r0
 libstdc++-dev=15.2.0-r5
 libstdc++=15.2.0-r5
 libunistring=1.4.2-r0
@@ -105,9 +105,9 @@ meson=1.11.1-r0
 mpc1=1.3.1-r1
 mpdecimal=4.0.1-r0
 mpfr4=4.2.2-r0
-musl-dev=1.2.6-r2
-musl-utils=1.2.6-r2
-musl=1.2.6-r2
+musl-dev=1.2.6-r3
+musl-utils=1.2.6-r3
+musl=1.2.6-r3
 ncurses-dev=6.6_p20260516-r0
 ncurses-terminfo-base=6.6_p20260516-r0
 nghttp2-libs=1.70.0-r0

diff --git a/versions.yaml b/versions.yaml
@@ -55,7 +55,7 @@
   kind: image
   source: mirror.gcr.io/library/alpine
   version: '3.24'
-  pin: sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6
+  pin: sha256:be2656061b536c1883c4034790e21d0a09c5aaaf51968b89368a3c0371ea2c9a
   track: digest
   note: >-
     the musl builder of the static QEMU and e2fsprogs, and the base of the QEMU runtime image.
@@ -67,9 +67,9 @@
 
 - name: kernel
   kind: download
-  source: https://git.kernel.org/torvalds/t/linux-{version}.tar.gz
-  version: 7.3-rc5
-  pin: 382d6aa48640351df7da6321e156c39155b4a99b0985d4370f7e608729987453
+  source: https://cdn.kernel.org/pub/linux/kernel/v{major}.x/linux-{version}.tar.xz
+  version: 7.3
+  pin: 87363c24f10e06321eb362765521094e94471f6bff8bce2d6b3e40f39f004953
   track: kernel-stable
   note: >-
     kernel/Dockerfile. A new kernel for every guest's next boot; checkpoints keep resuming, each
@@ -84,7 +84,7 @@
   kind: image
   source: mirror.gcr.io/library/debian
   version: trixie
-  pin: sha256:913f6706df59a68922d1dd08f78c2476560a8d367897200a6005b00e5f67c2d5
+  pin: sha256:4c25275446ca371766b8b093c696782eabce06263fccacb8d5d813b3dc44b308
   track: digest
   note: >-
     the kernel's toolchain (and qboot's and the floor kernel's), with its packages from
@@ -107,7 +107,7 @@
 
 - name: debian-snapshot
   kind: date
-  version: 20261014T000000Z
+  version: 20261026T000000Z
   track: today
   note: >-
     the Debian archive the kernel's toolchain is installed from, as it stood then, and the
@@ -130,7 +130,7 @@
   kind: image
   source: mirror.gcr.io/library/ubuntu
   version: '26.04'
-  pin: sha256:f144425ff09be612d6d9ad965196e9cdc23dae1f42110a8a11a3e9a8198759f7
+  pin: sha256:c098726dd9b9733f3e885f8de0ef375206a311b0a317eadc40d347b1115fb944
   track: digest
   note: >-
     image/Dockerfile: the container mkosi runs in, and where its apt and keyring come from.
@@ -163,8 +163,8 @@
 - name: git-lfs
   kind: download
   source: https://github.com/git-lfs/git-lfs/releases/download/v{version}/git-lfs-linux-amd64-v{version}.tar.gz
-  version: 3.8.0
-  pin: e455e00f15d9b95661b8d53498ffb0c3367962cf1ec73c31ab7369516cd6ab8d
+  version: 3.8.1
+  pin: e72cf723a4a660438862282e8aecf3885fc8123e88bfcad534cf6b941a354b75
   track: tags https://github.com/git-lfs/git-lfs.git
   note: >-
     image/Dockerfile hands it to install-dev-tools.sh, as task. The pin can be checked against
@@ -173,8 +173,8 @@
 - name: buildkit
   kind: download
   source: https://github.com/moby/buildkit/releases/download/v{version}/buildkit-v{version}.linux-amd64.tar.gz
-  version: 0.34.0
-  pin: 14813b1fb2a40082114e6d386c6fc5e7dd5298176ce7ee1a18bc33e73e109ac3
+  version: 0.34.1
+  pin: a59539daf547fe0958efe2d07e41c0a6944e1112a66d7e519ec1cf5b673ef15b
   track: tags https://github.com/moby/buildkit.git
   note: >-
     image/Dockerfile hands it to install-dev-tools.sh, as task: buildctl and buildkitd. The
@@ -212,7 +212,7 @@
 - name: cosign
   kind: module
   source: github.com/sigstore/cosign/v3/cmd/cosign
-  version: v3.0.6
+  version: v3.1.4
   track: github-release https://github.com/sigstore/cosign
   note: >-
     task boot:compat checks the release it fetches with it, on the KVM runner, which has no