From b0ea43f5fa3e4779c2651456f76a3be23659ccdc Mon Sep 17 00:00:00 2001
From: "aio-fleetbot[bot]"
 <280910390+aio-fleetbot[bot]@users.noreply.github.com>
Date: Sat, 25 Jul 2026 11:48:31 +0000
Subject: [PATCH] chore(sync): update upstream pins for sure-aio

---
 CHANGELOG.alpha.md | 16 ++++++++++++++++
 Dockerfile         |  4 ++--
 Dockerfile.alpha   |  6 +++---
 3 files changed, 21 insertions(+), 5 deletions(-)

diff --git a/CHANGELOG.alpha.md b/CHANGELOG.alpha.md
index a87dd49..8db9f05 100644
--- a/CHANGELOG.alpha.md
+++ b/CHANGELOG.alpha.md
@@ -6,6 +6,22 @@ are upstreamed or promoted to stable. Alpha uses the dedicated
 `jsonbored/sure-aio-alpha` image repo so testing tags stay out of the stable
 `jsonbored/sure-aio` package.
 
+## 0.7.3-alpha.5-aio.1 - 2026-07-25
+
+### Build
+
+- Track upstream Sure Alpha 0.7.3-alpha.5.
+- Publish Docker Hub and GHCR tags with the configured component revision tag.
+
+### Component Customizations
+
+- Preserve the Sure AIO alpha import-limit overlay documented in `docs/alpha-lane.md`.
+- Preserve the strict SureImport preflight/failure overlay until the pinned upstream alpha includes equivalent behavior.
+- Preserve the route-parity importer overlay for Enhanced NDJSON split/transfer proof packages until upstream carries it.
+- Keep `SURE_IMPORT_MAX_NDJSON_SIZE_MB` and `SURE_IMPORT_MAX_ROWS` alpha-only.
+- Do not add dirty-target taxonomy merge as a Unraid template or environment control.
+- Keep alpha passkey/WebAuthn template controls separate from stable.
+
 ## 0.7.2-alpha.7-aio.2 - 2026-06-18
 
 ### Maintenance
diff --git a/Dockerfile b/Dockerfile
index b1db10f..c70889e 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,8 +1,8 @@
 # syntax=docker/dockerfile:1@sha256:2780b5c3bab67f1f76c781860de469442999ed1a0d7992a5efdf2cffc0e3d769
 # checkov:skip=CKV_DOCKER_8: s6-overlay entrypoint must start as root so init scripts can prepare filesystem state before dropping privileges
 
-ARG UPSTREAM_VERSION=0.7.1-hotfix.1
-ARG UPSTREAM_IMAGE_DIGEST=sha256:64fa5951bcd426863759f5f06cf0316522bc5ecb3552bb6894f4101ca8708f6f
+ARG UPSTREAM_VERSION=0.7.2
+ARG UPSTREAM_IMAGE_DIGEST=sha256:96155b20c0b71f8e2ab960ab5aba8fba9df64c6a40ec581eca20af2b20ab089c
 ARG PGVECTOR_VERSION=0.8.2
 FROM jsonbored/aio-base:s6-3.2.1.0@sha256:07db479a01a95ba28480b4605f5d1cc8bedb574b77cf167ee46e29b9558fee90 AS aio-base
 
diff --git a/Dockerfile.alpha b/Dockerfile.alpha
index b0c316b..c40052a 100644
--- a/Dockerfile.alpha
+++ b/Dockerfile.alpha
@@ -1,9 +1,9 @@
 # syntax=docker/dockerfile:1@sha256:2780b5c3bab67f1f76c781860de469442999ed1a0d7992a5efdf2cffc0e3d769
 # checkov:skip=CKV_DOCKER_8: s6-overlay entrypoint must start as root so init scripts can prepare filesystem state before dropping privileges
 
-ARG UPSTREAM_VERSION=0.7.2-alpha.7
-ARG UPSTREAM_IMAGE_DIGEST=sha256:8eada80908cbb26dcb7a21fc7993df9ba8db953904742258345e2ebd1e793e81
-ARG AIO_REVISION=2
+ARG UPSTREAM_VERSION=0.7.3-alpha.5
+ARG UPSTREAM_IMAGE_DIGEST=sha256:df1a278df6f0b5f9afd0d3b7bc925d8aa00820e48320137cc2859018db89fba6
+ARG AIO_REVISION=1
 ARG PGVECTOR_VERSION=0.8.2
 FROM jsonbored/aio-base:s6-3.2.1.0@sha256:07db479a01a95ba28480b4605f5d1cc8bedb574b77cf167ee46e29b9558fee90 AS aio-base