# Last-known-good versions of bundled / pulled dependencies.
# The check-windows-updates GitHub workflow reads this file weekly and
# opens a tracking issue when upstream state has drifted from these
# values. Two drift signals are tracked:
#
# - Release tag (``dockur=`` / ``dockur-arm=``): a new dockur release on
#   GitHub. The issue links the release notes.
# - ``:latest`` digest (``dockur-digest=`` / ``dockur-arm-digest=``):
#   the image was rebuilt without a release tag bump. This is usually
#   an upstream security patch baked into the same tag; the issue
#   nudges a deliberate pin update.
#
# When you bump a value here, also refresh the matching pin in
# ``src/winpodx/core/config.py`` (``DOCKUR_IMAGE_PIN`` /
# ``DOCKUR_IMAGE_ARM_PIN``) if you intend to roll the new image
# forward. The pin and these baselines are decoupled on purpose:
# baselines describe what the upstream currently ships; the pin
# describes what winpodx deliberately uses.
#
# Format: <key>=<value>
dockur=v6.05
dockur-digest=sha256:0cff9eb0e7aee9953e55bc682852ca4fdca233145a58ae1ec94f0b0c01a2ed30
dockur-arm=v6.05
dockur-arm-digest=sha256:746e7d94228e10c404a06bb1b0c7f972b953b1e706243bd371dc05b7cc4b8864
