fix(docker): bump the docker-minor group in /apps/cli-go/pkg/config/templates with 3 updates (#5517)

Bumps the docker-minor group in /apps/cli-go/pkg/config/templates with 3
updates: supabase/studio, supabase/realtime and supabase/storage-api.

Updates `supabase/studio` from 2026.06.03-sha-0bca601 to
2026.06.08-sha-8af2bb0

Updates `supabase/realtime` from v2.103.4 to v2.105.0

Updates `supabase/storage-api` from v1.60.8 to v1.60.11


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Julien Goux <hi@jgoux.dev>

Author: dependabot[bot]

apps/cli-e2e/src/tests/stack.e2e.test.ts

@@ -73,7 +73,7 @@ describe("services", () => {
     expect(result.stdout).toContain("storage");
   });
 
-  testParity(["services"]);
+  testParity(["services"], { normalizeVersions: false });
 });
 
 // ---------------------------------------------------------------------------

apps/cli-e2e/src/tests/test-context.ts

@@ -145,6 +145,7 @@ export function testParity(
     failureType?: FailureType;
     workspaceSetup?: (dir: string) => void;
     sortStdoutRows?: boolean;
+    normalizeVersions?: boolean;
   },
 ): void {
   const label = opts?.failureType
@@ -169,6 +170,7 @@ export function testParity(
           accessToken: ACCESS_TOKEN,
           workspaceSetup: opts?.workspaceSetup,
           sortStdoutRows: opts?.sortStdoutRows,
+          normalize: { versions: opts?.normalizeVersions },
         },
         cmd,
       );

apps/cli-go/pkg/config/templates/Dockerfile

@@ -5,14 +5,14 @@ FROM library/kong:2.8.1 AS kong
 FROM axllent/mailpit:v1.22.3 AS mailpit
 FROM postgrest/postgrest:v14.13 AS postgrest
 FROM supabase/postgres-meta:v0.96.6 AS pgmeta
-FROM supabase/studio:2026.06.03-sha-0bca601 AS studio
+FROM supabase/studio:2026.06.08-sha-8af2bb0 AS studio
 FROM darthsim/imgproxy:v3.8.0 AS imgproxy
 FROM supabase/edge-runtime:v1.74.0 AS edgeruntime
 FROM timberio/vector:0.53.0-alpine AS vector
 FROM supabase/supavisor:2.9.7 AS supavisor
 FROM supabase/gotrue:v2.189.0 AS gotrue
-FROM supabase/realtime:v2.103.4 AS realtime
-FROM supabase/storage-api:v1.60.8 AS storage
+FROM supabase/realtime:v2.105.0 AS realtime
+FROM supabase/storage-api:v1.60.11 AS storage
 FROM supabase/logflare:1.43.4 AS logflare
 # Append to JobImages when adding new dependencies below
 FROM supabase/pgadmin-schema-diff:cli-0.0.5 AS differ

apps/cli/src/globals.d.ts

@@ -2,3 +2,8 @@ declare module "*.md" {
   const content: string;
   export default content;
 }
+
+declare module "*Dockerfile" {
+  const content: string;
+  export default content;
+}

apps/cli/src/shared/services/services.shared.ts

@@ -3,6 +3,7 @@ import { makeApiClient, type ApiClient } from "@supabase/api/effect";
 import { Data, Duration, Effect, Exit, Redacted } from "effect";
 import * as HttpClient from "effect/unstable/http/HttpClient";
 import * as HttpClientRequest from "effect/unstable/http/HttpClientRequest";
+import serviceImagesDockerfile from "../../../../cli-go/pkg/config/templates/Dockerfile" with { type: "text" };
 import { renderGlamourTable } from "../../legacy/output/legacy-glamour-table.ts";
 
 export type RemoteServiceName = "postgres" | "auth" | "postgrest" | "storage";
@@ -19,28 +20,73 @@ interface ServiceImageSpec {
   readonly remoteService: RemoteServiceName | undefined;
 }
 
-// Mirrors the legacy `services` image matrix:
-// - source versions: `apps/cli-go/pkg/config/templates/Dockerfile`
-// - source order: `apps/cli-go/pkg/config/config.go` `GetServiceImages()`
-//
-// We keep this compiled into the TS CLI because the published package does not
-// ship the Go source tree at runtime, but the user-visible `services` output
-// still needs to match the bundled image manifest.
-const LOCAL_SERVICE_IMAGES = [
-  { image: "supabase/postgres:17.6.1.132", remoteService: "postgres" },
-  { image: "supabase/gotrue:v2.189.0", remoteService: "auth" },
-  { image: "postgrest/postgrest:v14.12", remoteService: "postgrest" },
-  { image: "supabase/realtime:v2.103.2", remoteService: undefined },
-  { image: "supabase/storage-api:v1.60.4", remoteService: "storage" },
-  { image: "supabase/edge-runtime:v1.74.0", remoteService: undefined },
-  {
-    image: "supabase/studio:2026.06.03-sha-0bca601",
-    remoteService: undefined,
-  },
-  { image: "supabase/postgres-meta:v0.96.6", remoteService: undefined },
-  { image: "supabase/logflare:1.43.3", remoteService: undefined },
-  { image: "supabase/supavisor:2.9.7", remoteService: undefined },
-] as const satisfies ReadonlyArray<ServiceImageSpec>;
+interface DockerfileImageSpec {
+  readonly alias: string;
+  readonly image: string;
+}
+
+interface ServiceImageAliasSpec {
+  readonly alias: string;
+  readonly remoteService: RemoteServiceName | undefined;
+}
+
+const SERVICE_IMAGE_ALIASES: ReadonlyArray<ServiceImageAliasSpec> = [
+  { alias: "pg", remoteService: "postgres" },
+  { alias: "gotrue", remoteService: "auth" },
+  { alias: "postgrest", remoteService: "postgrest" },
+  { alias: "realtime", remoteService: undefined },
+  { alias: "storage", remoteService: "storage" },
+  { alias: "edgeruntime", remoteService: undefined },
+  { alias: "studio", remoteService: undefined },
+  { alias: "pgmeta", remoteService: undefined },
+  { alias: "logflare", remoteService: undefined },
+  { alias: "supavisor", remoteService: undefined },
+];
+
+const FROM_LINE_PATTERN = /^FROM\s+(.+):([^:\s]+)\s+AS\s+([^\s#]+)/i;
+
+export function parseDockerfileServiceImages(
+  dockerfile: string,
+): ReadonlyArray<DockerfileImageSpec> {
+  return dockerfile
+    .split("\n")
+    .map((line) => line.trim())
+    .flatMap((line) => {
+      const match = FROM_LINE_PATTERN.exec(line);
+      if (match === null) {
+        return [];
+      }
+
+      const [, repository, tag, alias] = match;
+      if (repository === undefined || tag === undefined || alias === undefined) {
+        return [];
+      }
+
+      return [{ alias, image: `${repository}:${tag}` }];
+    });
+}
+
+export function localServiceImagesFromDockerfile(
+  dockerfile: string,
+): ReadonlyArray<ServiceImageSpec> {
+  const imagesByAlias = new Map(
+    parseDockerfileServiceImages(dockerfile).map((service) => [service.alias, service.image]),
+  );
+
+  return SERVICE_IMAGE_ALIASES.map((service) => {
+    const image = imagesByAlias.get(service.alias);
+    if (image === undefined) {
+      throw new Error(`Missing service image alias '${service.alias}' in Dockerfile manifest.`);
+    }
+
+    return {
+      image,
+      remoteService: service.remoteService,
+    };
+  });
+}
+
+const LOCAL_SERVICE_IMAGES = localServiceImagesFromDockerfile(serviceImagesDockerfile);
 
 const TABLE_HEADERS = ["SERVICE IMAGE", "LOCAL", "LINKED"] as const;
 
@@ -61,14 +107,14 @@ function toServiceVersionRow(
   service: ServiceImageSpec,
   remote: Partial<Record<RemoteServiceName, string>> = {},
 ): ServiceVersionRow {
-  const parts = service.image.split(":");
-  const name = parts[0];
-  const local = parts[1];
-
-  if (name === undefined || local === undefined) {
+  const tagSeparator = service.image.lastIndexOf(":");
+  if (tagSeparator === -1) {
     throw new Error(`Invalid service image entry: ${service.image}`);
   }
 
+  const name = service.image.slice(0, tagSeparator);
+  const local = service.image.slice(tagSeparator + 1);
+
   return {
     name,
     local,

apps/cli/src/shared/services/services.shared.unit.test.ts

@@ -1,9 +1,12 @@
 import { describe, expect, test } from "vitest";
 import { Effect, Redacted } from "effect";
 import { FetchHttpClient } from "effect/unstable/http";
+import serviceImagesDockerfile from "../../../../cli-go/pkg/config/templates/Dockerfile" with { type: "text" };
 import {
   fetchLinkedServiceVersions,
   listLocalServiceVersions,
+  localServiceImagesFromDockerfile,
+  parseDockerfileServiceImages,
   renderServicesTable,
   renderServicesWarning,
 } from "./services.shared.ts";
@@ -17,6 +20,54 @@ const runLinkedFetch = (input: Parameters<typeof fetchLinkedServiceVersions>[0])
   Effect.runPromise(fetchLinkedServiceVersions(input).pipe(Effect.provide(FetchHttpClient.layer)));
 
 describe("services shared", () => {
+  test("parses service images from Dockerfile FROM aliases", () => {
+    expect(
+      parseDockerfileServiceImages(`
+        # comment
+        FROM supabase/postgres:17.6.1.132 AS pg
+
+        RUN echo ignored
+        FROM localhost:5000/custom/image:1.2.3 AS custom
+      `),
+    ).toEqual([
+      { alias: "pg", image: "supabase/postgres:17.6.1.132" },
+      { alias: "custom", image: "localhost:5000/custom/image:1.2.3" },
+    ]);
+  });
+
+  test("fails clearly when the Dockerfile manifest misses a required service alias", () => {
+    expect(() =>
+      localServiceImagesFromDockerfile("FROM supabase/postgres:17.6.1.132 AS pg\n"),
+    ).toThrow("Missing service image alias 'gotrue' in Dockerfile manifest.");
+  });
+
+  test("derives local service versions from the Go Dockerfile manifest", () => {
+    const rows = listLocalServiceVersions();
+    const dockerfileImages = localServiceImagesFromDockerfile(serviceImagesDockerfile);
+    const expectedRows = dockerfileImages.map((service) => {
+      const tagSeparator = service.image.lastIndexOf(":");
+      return {
+        name: service.image.slice(0, tagSeparator),
+        local: service.image.slice(tagSeparator + 1),
+        remote: "",
+      };
+    });
+
+    expect(rows).toEqual(expectedRows);
+    expect(rows.map((row) => row.name)).toEqual([
+      "supabase/postgres",
+      "supabase/gotrue",
+      "postgrest/postgrest",
+      "supabase/realtime",
+      "supabase/storage-api",
+      "supabase/edge-runtime",
+      "supabase/studio",
+      "supabase/postgres-meta",
+      "supabase/logflare",
+      "supabase/supavisor",
+    ]);
+  });
+
   test("returns postgres only when no service-role key is available", async () => {
     const server = Bun.serve({
       port: 0,

apps/cli/vitest.config.ts

@@ -1,6 +1,22 @@
+import { readFileSync } from "node:fs";
 import { defineConfig } from "vitest/config";
 
+function dockerfileTextPlugin() {
+  return {
+    name: "dockerfile-text-loader",
+    load(id: string) {
+      const [filePath] = id.split("?", 2);
+      if (filePath?.endsWith("/Dockerfile") !== true) {
+        return undefined;
+      }
+
+      return `export default ${JSON.stringify(readFileSync(filePath, "utf8"))};`;
+    },
+  };
+}
+
 export default defineConfig({
+  plugins: [dockerfileTextPlugin()],
   test: {
     passWithNoTests: true,
     coverage: {
@@ -24,18 +40,21 @@ export default defineConfig({
     },
     projects: [
       {
+        plugins: [dockerfileTextPlugin()],
         test: {
           name: "unit",
           include: ["**/*.unit.test.ts"],
         },
       },
       {
+        plugins: [dockerfileTextPlugin()],
         test: {
           name: "integration",
           include: ["**/*.integration.test.ts"],
         },
       },
       {
+        plugins: [dockerfileTextPlugin()],
         test: {
           name: "e2e",
           include: ["**/*.e2e.test.ts"],

packages/cli-test-helpers/src/normalize.ts

@@ -29,21 +29,33 @@ export function sortTableRows(output: string): string {
   return result.join("\n");
 }
 
+export interface NormalizeOptions {
+  readonly versions?: boolean;
+}
+
 /**
  * Normalize CLI output by stripping non-deterministic content before parity
  * comparisons. Applied to both Go and ts-legacy output so spurious differences
  * in timestamps, versions, paths, and stack traces don't produce false failures.
  */
-export function normalize(output: string): string {
+export function normalize(output: string, options: NormalizeOptions = {}): string {
+  const normalizeVersions = options.versions ?? true;
+  const withoutAnsi = output
+    // 1. Strip ANSI escape codes (color, bold, reset, etc.) — \u001b is ESC
+    // eslint-disable-next-line no-control-regex
+    .replace(/\u001b\[[0-9;]*[a-zA-Z]/g, "");
+  const withoutVersions = normalizeVersions
+    ? withoutAnsi.replace(
+        // 2. Semantic version strings (e.g. 1.187.0, v2.0.0-rc.1, v14.13).
+        //    Lookbehind prevents matching mid-IP-address (e.g. 0.0.1 inside 127.0.0.1).
+        //    Lookahead prevents matching where more dotted-number segments follow.
+        /(?<![.\d])\bv?\d+\.\d+(?:\.\d+)?(?:-[\w.]+)?\b(?!\.)/g,
+        "<VERSION>",
+      )
+    : withoutAnsi;
+
   return (
-    output
-      // 1. Strip ANSI escape codes (color, bold, reset, etc.) — \u001b is ESC
-      // eslint-disable-next-line no-control-regex
-      .replace(/\u001b\[[0-9;]*[a-zA-Z]/g, "")
-      // 2. Semantic version strings (e.g. 1.187.0, v2.0.0-rc.1, v14.13).
-      //    Lookbehind prevents matching mid-IP-address (e.g. 0.0.1 inside 127.0.0.1).
-      //    Lookahead prevents matching where more dotted-number segments follow.
-      .replace(/(?<![.\d])\bv?\d+\.\d+(?:\.\d+)?(?:-[\w.]+)?\b(?!\.)/g, "<VERSION>")
+    withoutVersions
       // 3. ISO-8601 timestamps (2026-04-15T10:46:15Z or with milliseconds)
       .replace(/\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z/g, "<TIMESTAMP>")
       // 4. Display timestamps (2026-04-15 10:46:15 — space-separated, no T)

packages/cli-test-helpers/src/normalize.unit.test.ts

@@ -15,6 +15,12 @@ describe("normalize", () => {
     expect(normalize("Version: 0.1.0-rc.1")).toBe("Version: <VERSION>");
   });
 
+  it("can preserve semantic version strings", () => {
+    expect(normalize("postgrest/postgrest:v14.13", { versions: false })).toBe(
+      "postgrest/postgrest:v14.13",
+    );
+  });
+
   it("does not normalize IP addresses as version strings", () => {
     expect(normalize("host 127.0.0.1")).toBe("host 127.0.0.1");
     expect(normalize("192.168.1.1")).toBe("192.168.1.1");

packages/cli-test-helpers/src/parity.ts

@@ -2,7 +2,7 @@ import { createHash } from "node:crypto";
 import { readFileSync } from "node:fs";
 import { join } from "node:path";
 import { createHarness, exec, makeTempDir } from "./harness.ts";
-import { normalize, sortTableRows } from "./normalize.ts";
+import { normalize, type NormalizeOptions, sortTableRows } from "./normalize.ts";
 
 // ---------------------------------------------------------------------------
 // Table parsing (Level 2)
@@ -215,13 +215,14 @@ async function collectRunResult(
   dir: string,
   apiUrl: string,
   extraEnv?: Record<string, string>,
+  normalizeOptions?: NormalizeOptions,
 ): Promise<RunResult> {
   const result = await exec(harness, cmd, extraEnv ? { env: extraEnv } : undefined);
   const requests = await fetchRequestLog(apiUrl);
   const files = snapshotChangedFiles(dir);
   return {
-    stdout: normalize(result.stdout),
-    stderr: normalize(result.stderr),
+    stdout: normalize(result.stdout, normalizeOptions),
+    stderr: normalize(result.stderr, normalizeOptions),
     exitCode: result.exitCode,
     requests,
     files,
@@ -311,6 +312,8 @@ export interface ParityOptions {
   sortStdoutRows?: boolean;
   /** Additional environment variables injected into both CLI subprocesses. */
   extraEnv?: Record<string, string>;
+  /** Fine-grained normalization controls for stdout/stderr parity comparison. */
+  normalize?: NormalizeOptions;
 }
 
 /**
@@ -341,6 +344,7 @@ export async function runParity(opts: ParityOptions, cmd: string[]): Promise<voi
       goDir.path,
       opts.apiUrl,
       opts.extraEnv,
+      opts.normalize,
     );
 
     await fetch(`${opts.apiUrl}/_ctrl/requests`, { method: "DELETE" });
@@ -357,6 +361,7 @@ export async function runParity(opts: ParityOptions, cmd: string[]): Promise<voi
       tsDir.path,
       opts.apiUrl,
       opts.extraEnv,
+      opts.normalize,
     );
 
     // Self-cleaning: reset after ts-legacy so callers start with a clean log.