From 0af45a0c9716bdbf7a33764ada2c0d47a9c0a76c Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Tue, 10 Nov 2026 21:13:48 +0000
Subject: [PATCH 1/2] chore: update module
 github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs to v1.92.2

---
 Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Dockerfile b/Dockerfile
index f8672e434..9f16de215 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -882,7 +882,7 @@ RUN set -e; \
     # renovate: datasource=go depName=github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream
     _retry go get github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.27; \
     # renovate: datasource=go depName=github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs
-    _retry go get github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.92.1; \
+    _retry go get github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.92.2; \
     _retry go get github.com/aws/aws-sdk-go-v2/service/kinesis@v1.43.7; \
     _retry go get github.com/aws/aws-sdk-go-v2/service/s3@v1.102.1; \
     # CVE-2026-32952: go-ntlmssp DoS via malicious NTLM challenge response

From 64be8386456396cb84a103e9596076166153ff9f Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Tue, 10 Nov 2026 21:33:58 +0000
Subject: [PATCH 2/2] chore(docker): sync toolchain image pin to
 caddy-crowdsec-2dfc3e79a8c446d1

---
 Dockerfile | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 9f16de215..7fa7c4bce 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -19,8 +19,8 @@ ARG CHARON_TOOLCHAIN_IMAGE=ghcr.io/wikid82/charon-toolchain
 # NOT Renovate-tracked (a content-hash tag has no series to follow, N7) — the
 # toolchain-image.yml bot owns these two lines. DIGEST is the arch-independent
 # manifest-list (OCI index) digest, so one pin covers linux/amd64 + linux/arm64.
-ARG CHARON_TOOLCHAIN_TAG=caddy-crowdsec-2ae83568f0fc23e9
-ARG CHARON_TOOLCHAIN_DIGEST=sha256:2fed4bb3067cb23229e7628590f6a0e2397bf44998ad913501a06768d24704c8
+ARG CHARON_TOOLCHAIN_TAG=caddy-crowdsec-2dfc3e79a8c446d1
+ARG CHARON_TOOLCHAIN_DIGEST=sha256:beb096b24494e80db70394a3be29e4e77e9e4846a879cbd7de0af8c5de0eec43
 
 # Stage selector — default consumes the prebuilt toolchain image (no compile).
 # Fork PRs / bootstrap / offline builds pass