From ce21a431f5e5e28a8fb47882025332d9941a0035 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 10 Nov 2026 23:56:26 +0000
Subject: [PATCH] fix(web): upgrade libxslt to 1.1.43-r4 in the web image

The v0.4.0 release run failed the Trivy gate on the web image: the
nginx alpine base ships libxslt 1.1.43-r3 with HIGH CVE-2026-87636 and
CVE-2026-9947, both fixed in 1.1.43-r4 (alpine 3.24 main).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Claude <noreply@anthropic.com>
---
 web/Dockerfile | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/web/Dockerfile b/web/Dockerfile
index 06d59463d..39e212359 100644
--- a/web/Dockerfile
+++ b/web/Dockerfile
@@ -59,13 +59,14 @@ ENV API_UPSTREAM=http://gameplane-api.gameplane-system.svc.cluster.local
 # (CVE-2026-111497) and curl/libcurl 8.22.0-r0 (CVE-2026-92392); Trivy fails
 # the publish on both. It also ships libexpat 2.9.0-r0 (CVE-2026-113351,
 # CVE-2026-115506, CVE-2026-117610, CVE-2026-118370), musl/musl-utils 1.2.6-r2
-# (CVE-2026-107891) and zlib 1.3.2-r0 (CVE-2026-85091). Upgrade them all to the
+# (CVE-2026-107891), zlib 1.3.2-r0 (CVE-2026-85091) and libxslt 1.1.43-r3
+# (CVE-2026-87636, CVE-2026-9947). Upgrade them all to the
 # Alpine 3.24 fixes as root, then drop back to the base image's unprivileged
 # nginx user (uid 101).
 USER root
 RUN apk add --no-cache brotli-libs~=1.2.1 curl~=8.23.0 libcurl~=8.23.0 \
       'libexpat>=2.10.0-r0' 'musl>=1.2.6-r3' 'musl-utils>=1.2.6-r3' \
-      'zlib>=1.3.2-r1'
+      'zlib>=1.3.2-r1' 'libxslt>=1.1.43-r4'
 USER 101
 
 # Replace the base image's default server block with ours.