chore(deps): update docker/dockerfile:1 docker digest to 4edf897

[scality-renovate]

This PR contains the following updates:

Package	Type	Update	Change
docker/dockerfile	syntax	digest	87999aa → 4edf897

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 9am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[github-actions]

Dependency Bump Evaluation

Package: docker/dockerfile (BuildKit Dockerfile frontend syntax directive)
Version change: digest 87999aa → 4edf897 (tag :1 unchanged; picks up Dockerfile frontend 1.28.0)
Semver bump type: digest (tracks latest :1 major)

Changes:

• Dockerfile frontend 1.28.0: allows default group syntax in COPY --chown, better validation of --chown/--link combinations
• Includes security fixes from 1.27.1 (September 30, 2026): Dockerfiles and .dockerignore over 16 MiB now rejected; HTTP archive reads for SOURCE_DATE_EPOCH capped at 16 MiB
• Underlying BuildKit 0.33.1 addressed 10 security advisories (proxy CA path traversal, unverified blob/layer digests, daemon panics from malformed inputs, memory exhaustion from oversized Dockerfiles)

Breaking changes: None. The COPY --chown default-group change only affects instructions using --chown; this Dockerfile does not use --chown or --link on any COPY instruction.

Security concerns: Positive — the update picks up multiple security fixes. No new attack surface introduced.

Impact on codebase: None. The only file changed is the # syntax= directive in Dockerfile (line 1). No Dockerfile instructions use affected features. The build and runtime behavior are unchanged.

CI status: lint passed | build, test, integration-test (16/17/18) still running at time of evaluation.

Recommendation: SAFE TO MERGE (once CI is green)

Notes: This is a routine digest pin update for the BuildKit Dockerfile frontend. The tag :1 is unchanged, so this stays on the same major. The new digest beneficially includes security hardening. Merge after CI passes.

— Claude Code