# Pinned upstream versions for the custom Caddy build.
#
# Sourced by cloudbuild.yaml and caddy/Containerfile (via --build-arg). Bumps
# are deliberate, reviewed changes — see ~/.claude/projects/.../memory/
# coraza_caddy_version.md for the maintenance/compat rationale.

XCADDY_VERSION=v0.4.5
CADDY_VERSION=v2.11.3

CORAZA_CADDY_MODULE=github.com/corazawaf/coraza-caddy/v2
CORAZA_CADDY_VERSION=v2.5.0

GCD_MODULE=github.com/caddy-dns/googleclouddns
GCD_VERSION=v1.1.0

# Container bases. Trixie (Debian 13) per the project convention.
GO_BUILDER_IMAGE=docker.io/library/golang:1-trixie
RUNTIME_IMAGE=gcr.io/distroless/base-debian13:nonroot

# Trivy used by the Cloud Build scan step. aquasec/trivy doesn't publish
# minor-only floating tags (no `0.70` pointing at the latest `0.70.X`), so
# we resolve dynamically: TRIVY_MINOR is the desired minor, caddy/cmd/trivy-
# version queries Docker Hub for the highest patch in that minor, and
# TRIVY_FALLBACK is used if the lookup fails (offline, API down, rate
# limited). No `v` prefix — Trivy's Docker tags don't carry one.
TRIVY_MINOR=0.70
TRIVY_FALLBACK=0.70.0