fix: Dockerfile to reduce vulnerabilities

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-ALPINE318-OPENSSL-8235200
- https://snyk.io/vuln/SNYK-ALPINE318-OPENSSL-8235200

.github/workflows/build.yml

@@ -81,7 +81,7 @@ jobs:
         run: echo ${{ steps.build.outputs.digest }}
 
       - name: Update hub description
-        uses: peter-evans/dockerhub-description@v3
+        uses: peter-evans/dockerhub-description@v4
         if: ${{ github.ref == 'refs/heads/master' }}
         with:
           username: jakejarvis

Dockerfile

@@ -1,6 +1,6 @@
 # the following version can be overridden at image build time with --build-arg
 # renovate: datasource=github-releases depName=gohugoio/hugo
-ARG HUGO_VERSION=0.113.0
+ARG HUGO_VERSION=0.124.1
 
 # remove/comment the following line completely to compile vanilla Hugo:
 ARG HUGO_BUILD_TAGS=extended
@@ -8,7 +8,7 @@ ARG HUGO_BUILD_TAGS=extended
 # ---
 
 # Hugo >= v0.81.0 requires Go 1.16+ to build
-FROM golang:1.21-alpine3.18 AS build
+FROM golang:1.22-alpine3.18 AS build
 
 # renew global args from above
 # https://docs.docker.com/engine/reference/builder/#scope
@@ -47,13 +47,13 @@ RUN go install github.com/yaegashi/muslstack@latest && \
 
 # ---
 
-FROM alpine:3
+FROM alpine:3.21.0
 
 # renew global args from above & pin any dependency versions
 ARG HUGO_VERSION
 # https://github.com/jgm/pandoc/releases
 # renovate: datasource=github-releases depName=jgm/pandoc
-ARG PANDOC_VERSION=3.1.11
+ARG PANDOC_VERSION=3.1.13
 # https://github.com/sass/dart-sass-embedded/releases
 # renovate: datasource=github-releases depName=sass/dart-sass-embedded
 ARG DART_SASS_VERSION=1.62.1