Update docker images

Author: renovate[bot]

.github/workflows/e2e-tests.yml

@@ -163,7 +163,7 @@ jobs:
           fi
           # Envoy is only used by the network-isolation test suite
           if [ "${{ matrix.title }}" = "network-isolation" ]; then
-            images="$images envoyproxy/envoy:distroless-v1.39.1@sha256:eb2c01c13125d1629637cb4e4cce7207009fb7cc2c8027f9742758549d15b6f4 python:3.15-slim@sha256:ea4f1f290e071bf7d28199cfb3e09f5dbad31b50e9c32fd58f2f2d7be915f3ae"
+            images="$images envoyproxy/envoy:distroless-v1.39.1@sha256:eb2c01c13125d1629637cb4e4cce7207009fb7cc2c8027f9742758549d15b6f4 python:3.15-slim@sha256:2da676046630d7bf14c6764ae1143dc7fa0377a53f94bf5a642f0b214aca5bce"
           fi
 
           for server in $servers; do

.github/workflows/security-scan.yml

@@ -72,7 +72,7 @@ jobs:
       - name: Report findings
         uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4
         with:
-          version: "1.30.1"
+          version: "1.31.1"
           inputs: .github/
           persona: regular
 
@@ -90,7 +90,7 @@ jobs:
       - name: Fail on new findings
         uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4
         with:
-          version: "1.30.1"
+          version: "1.31.1"
           inputs: .github/
           persona: regular
           min-severity: medium

cmd/thv/app/inspector/version.go

@@ -7,4 +7,4 @@ package inspector
 // Image specifies the image to use for the inspector command.
 // TODO: This could probably be a flag with a sensible default
 // Pinning to a specific version for stability.
-var Image = "ghcr.io/modelcontextprotocol/inspector:2.10.1"
+var Image = "ghcr.io/modelcontextprotocol/inspector:2.11.0"

deploy/charts/operator/values.yaml

@@ -261,4 +261,4 @@ operator:
 # -- Settings for the registry API workloads created by the operator.
 registryAPI:
   # -- Container image for registry API workloads created by the operator.
-  image: "ghcr.io/stacklok/thv-registry-api:v1.5.2"
+  image: "ghcr.io/stacklok/thv-registry-api:v1.5.3"

test/e2e/images/images.go

@@ -42,7 +42,7 @@ const (
 	// in Kubernetes tests. These run Flask-based Python services for testing authentication flows.
 	PythonImage = pythonImageURL + ":" + pythonImageTag
 
-	networkFixtureImageDigest = "sha256:ea4f1f290e071bf7d28199cfb3e09f5dbad31b50e9c32fd58f2f2d7be915f3ae"
+	networkFixtureImageDigest = "sha256:2da676046630d7bf14c6764ae1143dc7fa0377a53f94bf5a642f0b214aca5bce"
 	// NetworkFixtureImage is pinned because network-isolation tests use it for
 	// security-sensitive DNS and HTTP fixtures in the Docker-backed CI shard.
 	NetworkFixtureImage = pythonImageURL + ":" + pythonImageTag + "@" + networkFixtureImageDigest