Chore/complete dependency updates

[gocamille]

This PR consolidates all of the outstanding dependency updates from renovate and includes a fix for ARM64 builds in Docker.

Dependency Updates

This PR merges the following 5 Renovate branches. All updates are patch or minor versions:

1. Apollo Router: v2.9.0 -> v2.10.0 (Minor)
   • PR: chore(deps): update almalinux:10-minimal docker digest to 7e4fd6b #69
2. Apollo MCP Server: v1.2.1 -> v1.6.0 (Minor)
   • PR: chore(deps): update dependency apollographql/apollo-mcp-server to v1.6.0 - abandoned #70
   • Note: v1.6.0 requires glibc >= 2.38, necessitating the use of AlmaLinux 10.
3. Base Image (AlmaLinux): Digest update for almalinux:10-minimal (Patch)
   • PR: chore(deps): update dependency apollographql/router to v2.12.0 #68
4. OTEL Collector: Digest update for otel/opentelemetry-collector-contrib (Patch)
   • PR: chore(deps): update otel/opentelemetry-collector-contrib docker digest to f6e429c #66
5. GitHub Action Digests: Updates to various GH action digests (Patch)
   • PR: chore(deps): update github actions digests #65

tar compatibility fix

We encountered a build failure on QEMU-emulated ARM64 runners when using the standard GNU tar from AlmaLinux 10. The newer tar uses the openat2 syscall, which is not fully compatible with our CI's QEMU version, causing Invalid argument errors (exit code 2).

We verified that bsdtar avoids this issue. The Dockerfile now installs the bsdtar package and aliases it to tar to ensure compatibility across all platforms.

# Installed 'bsdtar' package and symlinked it to replace the standard 'tar' command
RUN microdnf install -y ... bsdtar && ln -sf /usr/bin/bsdtar /usr/bin/tar

[jonathanrainer]

Happy to approve this, but just for simplicity have we looked into bumping the QEMU version used here? For example we don't run this action in the workflow: https://github.com/docker/setup-qemu-action, but we could do. I'm just thinking if we can not have to install bsdtar that would be great :)

[gocamille]

Hi @jonathanrainer ! I tried adding docker/setup-qemu-action (both v3.7.0 and binfmt:master), but almalinux:10's tar uses openat2, which fails on the musl-compiled QEMU binaries used by the action. Since there's no stable upstream fix for this QEMU limitation yet, we unfortunately need to stick with bsdtar as a reliable workaround. (As an aside I'll try to open an issue at https://github.com/tonistiigi/binfmt to submit a fix for this almalinux:10/tar/arm64 issue. **Update: **it looks like an issue was opened for this 2 weeks ago, so I'll keep an eye on it: tonistiigi/binfmt#285)

I did keep the setup-qemu-action step in the workflow for the future, but also happy to remove it!

[jonathanrainer]

Hi @jonathanrainer ! I tried adding docker/setup-qemu-action (both v3.7.0 and binfmt:master), but almalinux:10's tar uses openat2, which fails on the musl-compiled QEMU binaries used by the action. Since there's no stable upstream fix for this QEMU limitation yet, we unfortunately need to stick with bsdtar as a reliable workaround. (As an aside I'll try to open an issue at https://github.com/tonistiigi/binfmt to submit a fix for this almalinux:10/tar/arm64 issue. **Update: **it looks like an issue was opened for this 2 weeks ago, so I'll keep an eye on it: tonistiigi/binfmt#285)

I did keep the setup-qemu-action step in the workflow for the future, but also happy to remove it!

No worries, thanks for doing the leg work on this! Happy to approve :)

[jonathanrainer]

LGTM