diff --git a/_bashbrew-cat b/_bashbrew-cat
index 45e3fec..39bb9c5 100644
--- a/_bashbrew-cat
+++ b/_bashbrew-cat
@@ -1,6 +1,6 @@
 Maintainers: Brandon Pfeifer <bpfeifer@influxdata.com> (@bnpfeife), Sven Rebhan <srebhan@influxdata.com> (@srebhan)
 GitRepo: https://github.com/influxdata/influxdata-docker
-GitCommit: 6496967c862c32efb249d610db48658d1bf7221d
+GitCommit: 61dfafef8cb60c34525c13ffcf48124f3f2cf08f
 
 Tags: 1.8, 1.8.10
 Architectures: amd64, arm32v7, arm64v8
@@ -23,9 +23,9 @@ Directory: chronograf/1.10
 Tags: 1.10-alpine, 1.10.9-alpine
 Directory: chronograf/1.10/alpine
 
-Tags: 1.11, 1.11.3, latest
+Tags: 1.11, 1.11.4, latest
 Architectures: amd64, arm32v7, arm64v8
 Directory: chronograf/1.11
 
-Tags: 1.11-alpine, 1.11.3-alpine, alpine
+Tags: 1.11-alpine, 1.11.4-alpine, alpine
 Directory: chronograf/1.11/alpine
diff --git a/_bashbrew-list b/_bashbrew-list
index c3696de..5c2d4ee 100644
--- a/_bashbrew-list
+++ b/_bashbrew-list
@@ -12,7 +12,7 @@ chronograf:1.10.9
 chronograf:1.10.9-alpine
 chronograf:1.11
 chronograf:1.11-alpine
-chronograf:1.11.3
-chronograf:1.11.3-alpine
+chronograf:1.11.4
+chronograf:1.11.4-alpine
 chronograf:alpine
 chronograf:latest
diff --git a/chronograf_alpine/Dockerfile b/chronograf_alpine/Dockerfile
index 57628e9..7ca249c 100644
--- a/chronograf_alpine/Dockerfile
+++ b/chronograf_alpine/Dockerfile
@@ -1,10 +1,10 @@
-FROM alpine:3.22
+FROM alpine:3.24
 
 RUN echo 'hosts: files dns' >> /etc/nsswitch.conf
 RUN apk add --no-cache ca-certificates setpriv && \
     update-ca-certificates
 
-ENV CHRONOGRAF_VERSION=1.11.3
+ENV CHRONOGRAF_VERSION=1.11.4
 
 RUN set -ex && \
     mkdir ~/.gnupg; \
diff --git a/chronograf_latest/Dockerfile b/chronograf_latest/Dockerfile
index ccb08d2..1635659 100644
--- a/chronograf_latest/Dockerfile
+++ b/chronograf_latest/Dockerfile
@@ -11,7 +11,7 @@ RUN set -ex && \
         gpg --keyserver hkp://keyserver.ubuntu.com --recv-keys "$key" ; \
     done
 
-ENV CHRONOGRAF_VERSION 1.11.3
+ENV CHRONOGRAF_VERSION 1.11.4
 RUN ARCH= && dpkgArch="$(dpkg --print-architecture)" && \
     case "${dpkgArch##*-}" in \
       amd64) ARCH='amd64';; \

Relevant Maintainers:

• chronograf: @bnpfeife @srebhan

I see one check failing due to:

Invalid 'FROM' + 'Architectures' combinations detected:

 - chronograf:1.8-alpine (FROM alpine:3.20) -- completely unsupported base!
 - chronograf:1.9-alpine (FROM alpine:3.20) -- completely unsupported base!

There was notification of the Alpine 3.20 end of life in #21630 (comment).

Please either update the 1.8 & 1.9 images to use alpine:3.21 or newer; or drop them if they are no longer supported.

@yosifkit I need some advice. We currently keep the container versions in lockstep with the software version so users know what they get. If we now change the base image we will get two different containers (with different hashes) into the wild depending on when the user pulled the image. This is problematic, isn't it, as setups are no longer reproducible because you get a different container.

Do you see a way around it without removing old versions or give-up on the version lockstep?

we will get two different containers (with different hashes) into the wild depending on when the user pulled the image

That is already the case in official images since we "Actively rebuild for updates and security fixes". We rebuild images when their parent image is updated in order to provide system package updates. If users need reproducible images, then they should pull by image digest and not tags.

These are all currently the same image (https://oci.dag.dev/?image=chronograf%3A1.9-alpine):

• chronograf:1.9-alpine, chronograf:1.9.4-alpine
• chronograf@sha256:0f80cd3823ff72714fb0be9429588b58a6cd474733e0369bc7f9181346b1d5cd
• chronograf:1.9-alpine@sha256:0f80cd3823ff72714fb0be9429588b58a6cd474733e0369bc7f9181346b1d5cd
  • in this case the tag is ignored and is just for humans
• chronograf@sha256:f621eed42ec67e2c0af874c13b22cf7c5eca4a2f92496e0e777e83e0d0e54a18
  • this one skips the image index and is directly the image manifest for linux/amd64

container versions in lockstep with the software version

This is still the case; the version of chronograf is locked to be the same as the image tags. It is just the software around it that is updated (like ca-certificates and base image packages). The git history of the files in https://github.com/docker-library/repo-info/tree/master/repos/chronograf (remote and local directories) can show the rebuilds that have happened for specific tags over time. We scrape that data from the registry API and the built images themselves.

If you want unchanging/historical tags, then they should be removed from the library/ file. We don't delete tags from Docker Hub, so they will remain pullable.