[onel]

Moves the OS package lock forward (BUILD.md # 1b # The OS package lock). Made by .github/workflows/os-lock-bump.yml.

• Debian snapshot: 20261009T083023Z to 20261024T082158Z
• Docker pins: moved to the newest version within each major (dev/os-lock/third-party.lock)

Security: 6 of the 12 changed packages come from trixie-security. Release rule: cut an OS patch release with this change within 7 days (docs/dev/contributing.md # Release model).

Package	From	To	Source
ca-certificates	20250419	20250419+deb13u1	trixie-security
containerd.io	2.4.1-2~debian.13~trixie	2.4.2-3~debian.13~trixie
docker-ce	5:29.9.0-1~debian.13~trixie	5:29.9.2-1~debian.13~trixie
docker-ce-cli	5:29.9.0-1~debian.13~trixie	5:29.9.2-1~debian.13~trixie
docker-compose-plugin	5.6.0-1~debian.13~trixie	5.6.1-1~debian.13~trixie
libbrotli1	1.1.0-2+b7	1.1.0-2+deb13u1	trixie-security
libcurl3t64-gnutls	8.14.1-2+deb13u5	8.14.1-2+deb13u7	trixie-security
libexpat1	2.8.3-1~deb13u1	2.9.0-1~deb13u1	trixie-security
linux-image-6.12.111+deb13-amd64	6.12.111-1	(removed)
linux-image-6.12.113+deb13-amd64	(new)	6.12.113-1	trixie-security
linux-image-amd64	6.12.111-1	6.12.113-1	trixie-security
tzdata	2026c-0+deb13u1	2026e-0+deb13u1

A package was added or removed. The lean check fails until dev/cloud/expected-packages.txt lists the new set, so a person must review it.

Merging this puts the change on dev, not on any box. It ships with the next OS release (docs/dev/contributing.md # Release model).

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; no new blocking issue was found.

_{Reviews (7) · Last reviewed commit: "OS lock (security): ca-certificates 2025..." · Reviewed by Greptile}