chore(deps): bump Alpine 3.21→3.22, update CI actions and linter

- Dockerfile: alpine 3.21 → 3.22 (fewer CVEs per Docker Scout)
- release.yml: actions/checkout v4→v6, setup-go v5→v6, setup-buildx v3→v4
- ci.yml: golangci-lint v2.11.3 → v2.11.4
- DOCKERHUB.md: update Alpine version reference

.github/workflows/ci.yml

@@ -62,7 +62,7 @@ jobs:
       - name: Run golangci-lint
         uses: golangci/golangci-lint-action@v9
         with:
-          version: v2.11.3
+          version: v2.11.4
 
   coverage:
     name: Coverage

.github/workflows/release.yml

@@ -12,11 +12,11 @@ jobs:
   release:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@v6
         with:
           go-version-file: go.mod
 
@@ -32,7 +32,7 @@ jobs:
     needs: release
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Docker meta
         id: meta
@@ -45,7 +45,7 @@ jobs:
             type=raw,value=latest
 
       - uses: docker/setup-qemu-action@v4
-      - uses: docker/setup-buildx-action@v3
+      - uses: docker/setup-buildx-action@v4
 
       - uses: docker/login-action@v4
         with:

DOCKERHUB.md

@@ -119,7 +119,7 @@ docker exec unarr unarr doctor
 
 ## Image Details
 
-- **Base image:** Alpine 3.21
+- **Base image:** Alpine 3.22
 - **User:** `unarr` (UID 1000, GID 1000)
 - **Entrypoint:** `unarr start` (daemon mode)
 - **Read-only filesystem** — only mounted volumes are writable

Dockerfile

@@ -16,7 +16,7 @@ ARG VERSION=dev
 RUN CGO_ENABLED=0 go build -ldflags="-s -w -X github.com/torrentclaw/unarr/internal/cmd.Version=${VERSION}" -trimpath -o /unarr ./cmd/unarr/
 
 # ---- Runtime stage ----
-FROM alpine:3.21
+FROM alpine:3.22
 
 RUN apk upgrade --no-cache && \
     apk add --no-cache ca-certificates tzdata