diff --git a/lib/config/options/index.ts b/lib/config/options/index.ts
index 4114340dc1c..a87705184a1 100644
--- a/lib/config/options/index.ts
+++ b/lib/config/options/index.ts
@@ -659,7 +659,7 @@ const options: Readonly<RenovateOptions>[] = [
     description:
       'Change this value to override the default Renovate sidecar image.',
     type: 'string',
-    default: 'ghcr.io/renovatebot/base-image:13.33.8',
+    default: 'ghcr.io/renovatebot/base-image:13.33.9',
     globalOnly: true,
     deprecationMsg:
       'The usage of `binarySource=docker` is deprecated, and will be removed in the future',
diff --git a/package.json b/package.json
index d76ee866e14..0cdad26945a 100644
--- a/package.json
+++ b/package.json
@@ -192,7 +192,7 @@
     "@sindresorhus/is": "7.2.0",
     "@yarnpkg/core": "4.6.0",
     "@yarnpkg/parsers": "3.0.3",
-    "ae-cvss-calculator": "1.0.11",
+    "ae-cvss-calculator": "1.0.12",
     "agentkeepalive": "4.6.0",
     "async-mutex": "0.5.0",
     "aws4": "1.13.2",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 826d23bbc53..4079834436d 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -126,8 +126,8 @@ importers:
         specifier: 3.0.3
         version: 3.0.3
       ae-cvss-calculator:
-        specifier: 1.0.11
-        version: 1.0.11
+        specifier: 1.0.12
+        version: 1.0.12
       agentkeepalive:
         specifier: 4.6.0
         version: 4.6.0
@@ -2808,8 +2808,8 @@ packages:
     resolution: {integrity: sha512-TGw5yVi4saajsSEgz25grObGHEUaDrniwvA2qwSC060KfqGPdglhvPMA2lPIoxs3PQIItj2iag35fONcQqgUaQ==}
     engines: {node: '>=12.0'}
 
-  ae-cvss-calculator@1.0.11:
-    resolution: {integrity: sha512-Rhe/7hJ+9rFmDvcoIg2vNva1Lzm1gHZC5GJzhT6RceoCl9ZCK+fOl1cqKrvQsxSWoUITrt+ew73WPKpoDyilBQ==}
+  ae-cvss-calculator@1.0.12:
+    resolution: {integrity: sha512-YVO+dhb8sZubNeL9pqSlN5hyZGC8hkAwnThnd3EimUGZtJEMeuy4kMb7zMCAsBiMr/RxklH0oY7DCsFV/B7peg==}
 
   agent-base@7.1.4:
     resolution: {integrity: sha512-MnA+YT8fwfJPgBx3m60MNqakm30XOkyIoH1y6huTQvC0PwZG7ki8NacLBcrPbNoo8vEZy7Jpuk7+jMO+CUovTQ==}
@@ -9215,7 +9215,7 @@ snapshots:
 
   adm-zip@0.5.16: {}
 
-  ae-cvss-calculator@1.0.11: {}
+  ae-cvss-calculator@1.0.12: {}
 
   agent-base@7.1.4: {}
 
diff --git a/tools/docker/Dockerfile b/tools/docker/Dockerfile
index 45f4cd8749a..ea24ac0fdf0 100644
--- a/tools/docker/Dockerfile
+++ b/tools/docker/Dockerfile
@@ -5,19 +5,19 @@ ARG BASE_IMAGE_TYPE=slim
 # --------------------------------------
 # slim image
 # --------------------------------------
-FROM ghcr.io/renovatebot/base-image:13.33.8@sha256:6ceb42eb31cef033876d547fbaf23a1ff70bc6c175717e2968b0c21beb5ad0f9 AS slim-base
+FROM ghcr.io/renovatebot/base-image:13.33.9@sha256:e828902e2a063fa426fec36266df3258a9074015e0626b65acf5aeac917fb365 AS slim-base
 
 # --------------------------------------
 # full image
 # --------------------------------------
-FROM ghcr.io/renovatebot/base-image:13.33.8-full@sha256:bb2049bfc29eaa25fd33fce7ad90b29e651684aa999340347b262b7d8ba7362e AS full-base
+FROM ghcr.io/renovatebot/base-image:13.33.9-full@sha256:66d3ad6a34dc8cd19d58d5cee1e229f8b312469ff325dc0fa8af6bad1c219f8e AS full-base
 
 ENV RENOVATE_BINARY_SOURCE=global
 
 # --------------------------------------
 # build image
 # --------------------------------------
-FROM --platform=$BUILDPLATFORM ghcr.io/renovatebot/base-image:13.33.8@sha256:6ceb42eb31cef033876d547fbaf23a1ff70bc6c175717e2968b0c21beb5ad0f9 AS build
+FROM --platform=$BUILDPLATFORM ghcr.io/renovatebot/base-image:13.33.9@sha256:e828902e2a063fa426fec36266df3258a9074015e0626b65acf5aeac917fb365 AS build
 
 # We want a specific node version here
 # renovate: datasource=github-releases packageName=containerbase/node-prebuild versioning=node