From 1bca7a4361aacd4e28b9042fb12a0d788ab4b3dd Mon Sep 17 00:00:00 2001 From: Claude Date: Sat, 7 Nov 2026 17:12:09 +0000 Subject: [PATCH] fix(web): upgrade expat, musl and zlib in the web image Master's publish-edge Trivy scan fails the web image on 7 fixed HIGH CVEs shipped by nginxinc/nginx-unprivileged:1.31-alpine: libexpat 2.9.0-r0 (CVE-2026-113351, -115506, -117610, -118370), musl/musl-utils 1.2.6-r2 (CVE-2026-107891) and zlib 1.3.2-r0 (CVE-2026-85091). Add them to the existing apk upgrade line with the Alpine 3.24 fixed versions as minimums. Co-Authored-By: Claude Opus 5.5 Signed-off-by: Claude --- web/Dockerfile | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/web/Dockerfile b/web/Dockerfile index 3b2c7d46a..3f9eb8742 100644 --- a/web/Dockerfile +++ b/web/Dockerfile @@ -57,10 +57,15 @@ ENV API_UPSTREAM=http://gameplane-api.gameplane-system.svc.cluster.local # The base image (last rebuilt 2026-10-19) ships brotli-libs 1.2.0-r1 # (CVE-2026-111497) and curl/libcurl 8.22.0-r0 (CVE-2026-92392); Trivy fails -# the publish on both. Upgrade them to the Alpine 3.24 fixes as root, then drop -# back to the base image's unprivileged nginx user (uid 101). +# the publish on both. It also ships libexpat 2.9.0-r0 (CVE-2026-113351, +# CVE-2026-115506, CVE-2026-117610, CVE-2026-118370), musl/musl-utils 1.2.6-r2 +# (CVE-2026-107891) and zlib 1.3.2-r0 (CVE-2026-85091). Upgrade them all to the +# Alpine 3.24 fixes as root, then drop back to the base image's unprivileged +# nginx user (uid 101). USER root -RUN apk add --no-cache brotli-libs~=1.2.1 curl~=8.23.0 libcurl~=8.23.0 +RUN apk add --no-cache brotli-libs~=1.2.1 curl~=8.23.0 libcurl~=8.23.0 \ + 'libexpat>=2.10.0-r0' 'musl>=1.2.6-r3' 'musl-utils>=1.2.6-r3' \ + 'zlib>=1.3.2-r1' USER 101 # Replace the base image's default server block with ours.