fix(infra): pull MinIO from quay.io on a pinned tag, not Docker Hub

[marcelo-maciel]

Problem

MinIO withdrew minio/minio from Docker Hub. The repository is gone (GET https://hub.docker.com/v2/repositories/minio/minio/ answers {"message": "object not found"}), and a pull fails:

Error response from daemon: pull access denied for minio/minio, repository does not exist or may require 'docker login'

Everything in the kit that boots MinIO is broken on main today, with no change of ours involved:

• Integration tests. The Testcontainers harness starts a MinIO container per fixture, so container start throws and every test in the project fails. On the current main that is Failed: 724, Passed: 23 in Integration.Tests, plus Integration.Middleware.Tests.
• The Aspire AppHost (dotnet run --project src/Host/FSH.Starter.AppHost), the documented way to run the whole stack.
• The Docker Compose deployment under deploy/docker/.

Fix

The image is still published, at quay.io/minio/minio. The registry moves, and the tag is pinned:

File	Change
src/Tests/Integration.Tests/Infrastructure/FshWebApplicationFactory.cs	MinioBuilder("quay.io/minio/minio:RELEASE.2025-09-07T16-13-09Z")
src/Tests/Integration.Middleware.Tests/Infrastructure/MiddlewareWebApplicationFactory.cs	same
src/Host/FSH.Starter.AppHost/AppHost.cs	.WithImageRegistry("quay.io") + .WithImageTag(...)
deploy/docker/docker-compose.yml	image: quay.io/minio/minio:RELEASE.2025-09-07T16-13-09Z
deploy/docker/README.md	the service/image table

Why a pinned tag and not :latest. quay has not moved :latest since 2025-09-07, so both resolve to the same digest today and this changes nothing operationally. It removes the surprise of a silent move later, and keeps the test harness off a floating tag. Whether the kit should track a newer MinIO release, or a different S3-compatible image, is a separate call and not one to fold into an outage fix.

minio/mc (the minio-init one-shot in compose) is a different repository and still resolves on Docker Hub, so it is left alone.

While in the README's image table: the postgres and redis rows had drifted from what compose actually ships (postgres:18-alpine and valkey/valkey:9.1.0-alpine).

Also here: the two advisory fixes, or CI cannot go green

dotnet restore fails for the whole solution under TreatWarningsAsErrors on main right now, so this PR would be red regardless of the MinIO fix. Both are advisory-database drift rather than a code change: a commit green on 2026-08-10 is red today with no edits.

• Testcontainers.* 4.11.0 -> 4.14.0 (NU1903, GHSA-q939-rpr3-3284). 4.11.0 depends on SSH.NET 2025.1.0; 4.14.0 already depends on the patched 2026.0.0, so the advisory clears with no transitive pin to remember to remove later. This is the same fix as fix(deps): bump Testcontainers to 4.14.0 to clear the SSH.NET advisory #1369, deliberately, so the two do not conflict; happy to drop the commit if fix(deps): bump Testcontainers to 4.14.0 to clear the SSH.NET advisory #1369 lands first.
• Microsoft.SourceLink.GitHub 8.0.0 -> 10.0.401 (NU1902, GHSA-23fw-v26w-5fgq). 8.0.0 drags in Microsoft.Build.Tasks.Git 8.0.0 and the 8.x line has no patched release, so a transitive pin cannot fix it; the package itself has to move. 10.0.401 depends on Microsoft.Build.Tasks.Git 10.0.401, past the patched 10.0.303. It is build-time only (PrivateAssets="all") and referenced only where IsPackable == true, which is the CLI alone; src/Tools/** is excluded from the template, so the scaffold never sees it. Not covered by fix(deps): bump Testcontainers to 4.14.0 to clear the SSH.NET advisory #1369.

Verification

• docker pull minio/minio:latest fails with the error quoted above.
• docker pull quay.io/minio/minio:RELEASE.2025-09-07T16-13-09Z succeeds, digest sha256:14cea493d9a34af32f524e538b8346cf79f3321eff8e708c1e2960462bd8936e, the same digest :latest resolves to.
• dotnet restore src/FSH.Starter.slnx exits 0 with no NU19xx.
• dotnet build src/FSH.Starter.slnx -c Release -warnaserror: 0 warnings, 0 errors.
• dotnet test src/Tests/Integration.Tests -c Release against a real MinIO container on the pinned tag: 0 failed, up from 23 passed / 724 failed before the change.
• The Aspire manifest (--publisher manifest) renders the container as quay.io/minio/minio:RELEASE.2025-09-07T16-13-09Z, so the registry and tag overrides land where intended. minio/mc stays on Docker Hub, as expected.

Docs

Docs + changelog land in the separate fullstackhero/docs site: fullstackhero/docs#247.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.