chore: update dependencies

Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

Author: renovate[bot]

.github/workflows/ci.yaml

@@ -32,7 +32,7 @@ jobs:
     steps:
       - name: gather-system-info
         id: system-info
-        uses: kenchan0130/[email protected].0
+        uses: kenchan0130/[email protected].1
         continue-on-error: true
       - name: print-system-info
         run: |

Dockerfile

@@ -1,11 +1,11 @@
-ARG DOCKER=docker:27.5.1-dind
+ARG DOCKER=docker:28.3.1-dind
 
 FROM $DOCKER AS docker
 
-FROM alpine:3.21.3 AS build-container-drone
+FROM alpine:3.22.0 AS build-container-drone
 
 # renovate: datasource=github-releases depName=docker/buildx
-ARG BUILDX_VERSION=v0.20.1
+ARG BUILDX_VERSION=v0.25.0
 # renovate: datasource=github-releases extractVersion=^v(?<version>.*)$ depName=hashicorp/terraform
 ARG TERRAFORM_VERSION=1.7.3
 
@@ -81,7 +81,7 @@ FROM scratch AS actions-runner-controller-source
 ADD https://github.com/actions/actions-runner-controller.git#${ACTIONS_RUNNER_CONTROLLER_VERSION}:runner /
 
 # Ref: https://github.com/actions/actions-runner-controller/blob/master/runner/actions-runner-dind.ubuntu-22.04.dockerfile
-FROM ubuntu:25.04 AS build-container-ghaction
+FROM ubuntu:plucky-20250619 AS build-container-ghaction
 
 ARG TARGETPLATFORM
 # renovate: datasource=github-releases extractVersion=^v(?<version>.*)$ depName=actions/runner
@@ -93,20 +93,20 @@ ARG CHANNEL=stable
 # renovate: datasource=github-releases extractVersion=^v(?<version>.*)$ depName=moby/moby
 ARG DOCKER_VERSION=27.5.1
 # renovate: datasource=github-releases depName=docker/compose
-ARG DOCKER_COMPOSE_VERSION=v2.33.0
+ARG DOCKER_COMPOSE_VERSION=v2.38.1
 # renovate: datasource=github-releases extractVersion=^v(?<version>.*)$ depName=yelp/dumb-init
 ARG DUMB_INIT_VERSION=1.2.5
 ARG RUNNER_USER_UID=1001
 ARG DOCKER_GROUP_GID=121
 
 # renovate: datasource=github-releases depName=google/go-containerregistry
-ARG CRANE_VERSION=v0.20.3
+ARG CRANE_VERSION=v0.20.6
 # renovate: datasource=github-releases depName=mikefarah/yq
-ARG YQ_VERSION=v4.45.1
+ARG YQ_VERSION=v4.45.4
 # renovate: datasource=github-releases depName=getsops/sops
-ARG SOPS_VERSION=v3.9.4
+ARG SOPS_VERSION=v3.10.2
 # renovate: datasource=github-tags depName=aws/aws-cli
-ARG AWSCLI_VERSION=2.24.5
+ARG AWSCLI_VERSION=2.27.49
 
 ENV DEBIAN_FRONTEND=noninteractive
 RUN apt-get update -y \

hack/scripts/setup-ci

@@ -5,7 +5,7 @@ set -ex
 export TAG=$(git log --oneline --format=%B -n 1 HEAD | head -n 1 | sed -r "/^release\(/ s/^release\((.*)\):.*$/\\1/; t; Q")
 
 # renovate: datasource=github-releases depName=moby/buildkit
-BUILDKIT_IMAGE="docker.io/moby/buildkit:v0.19.0"
+BUILDKIT_IMAGE="docker.io/moby/buildkit:v0.23.2"
 
 # setup buildkit across amd64/arm64 workers
 function setup_buildkit() {