From a322e25f34897b2d463e4c1848ed0978f772b548 Mon Sep 17 00:00:00 2001
From: Chirag Aggarwal <chiragaggarwal5k@gmail.com>
Date: Thu, 30 Jul 2026 15:13:30 +0530
Subject: [PATCH] Pin docker-cli and compose apk packages to exact versions

Lock docker-cli=29.5.2-r0 and docker-cli-compose=2.40.3-r6 so Alpine
floats cannot silently bump the installer Docker client.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 CHANGES.md | 6 ++++++
 Dockerfile | 4 ++--
 tests.yaml | 4 ++--
 3 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/CHANGES.md b/CHANGES.md
index 4bbcdac..7721003 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -1,5 +1,11 @@
 # CHANGELOG
 
+## Version 1.4.5
+
+### Change
+
+* Pin `docker-cli` and `docker-cli-compose` apk packages to the exact versions already shipped in `1.4.4` (`29.5.2-r0` and `2.40.3-r6`) so Alpine package floats cannot silently bump the installer Docker client. Structure tests now assert those exact versions.
+
 ## Version 1.3.2
 
 ### Security
diff --git a/Dockerfile b/Dockerfile
index 9332369..5b90264 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -221,8 +221,8 @@ RUN apk update && \
     c-ares \
     certbot \
     freetype \
-    docker-cli \
-    docker-cli-compose \
+    docker-cli=29.5.2-r0 \
+    docker-cli-compose=2.40.3-r6 \
     git \
     icu-libs \
     imagemagick \
diff --git a/tests.yaml b/tests.yaml
index 69482b2..70c7fcb 100644
--- a/tests.yaml
+++ b/tests.yaml
@@ -16,11 +16,11 @@ commandTests:
   - name: 'Docker command'
     command: "docker"
     args: ["--version"]
-    expectedOutput: ["Docker version 29.*"]
+    expectedOutput: ["Docker version 29.5.2.*"]
   - name: 'Docker Compose command'
     command: "docker"
     args: ["compose", "version"]
-    expectedOutput: ["Docker Compose version v.*"]
+    expectedOutput: ["Docker Compose version v2.40.3"]
   - name: 'Git command'
     command: "git"
     args: ["--version"]