fix(profiler): rebuild images on patched OS packages and go1.26.10

docker/bpf/Dockerfile

@@ -1,4 +1,4 @@
-FROM golang:1.26.5-alpine AS agentbuild
+FROM golang:1.26.10-alpine AS agentbuild
 ENV GOTOOLCHAIN=local
 WORKDIR /go/src/github.com/nudgebee/application-profiler
 COPY . /go/src/github.com/nudgebee/application-profiler

docker/dummy/Dockerfile

@@ -1,4 +1,4 @@
-FROM golang:1.26.5-alpine AS agentbuild
+FROM golang:1.26.10-alpine AS agentbuild
 ENV GOTOOLCHAIN=local
 WORKDIR /go/src/github.com/nudgebee/application-profiler
 COPY . /go/src/github.com/nudgebee/application-profiler

docker/jvm/Dockerfile

@@ -1,5 +1,5 @@
 ARG JAVA_VERSION_TAG=21
-FROM golang:1.26.5-bookworm AS agentbuild
+FROM golang:1.26.10-bookworm AS agentbuild
 ENV GOTOOLCHAIN=local
 WORKDIR /go/src/github.com/nudgebee/application-profiler
 COPY . /go/src/github.com/nudgebee/application-profiler

docker/jvm/alpine/Dockerfile

@@ -1,6 +1,6 @@
 ARG JAVA_VERSION_TAG=21
 ARG ASYNCP_VERSION=2.9
-FROM golang:1.26.5-alpine AS agentbuild
+FROM golang:1.26.10-alpine AS agentbuild
 ENV GOTOOLCHAIN=local
 WORKDIR /go/src/github.com/nudgebee/application-profiler
 COPY . /go/src/github.com/nudgebee/application-profiler
@@ -61,6 +61,7 @@ RUN apk add --no-cache curl g++ git linux-headers make tar wget  \
 
 FROM alpine:3.23.4
 RUN mkdir -p /app/async-profiler/build  \
+    && apk upgrade --no-cache  \
     && apk add --no-cache procps coreutils
 COPY --from=agentbuild /go/bin/agent /app
 COPY --from=agentbuild /go/src/github.com/nudgebee/application-profiler/contrib/jvm/profiler.sh /app/async-profiler

docker/perf/Dockerfile

@@ -1,4 +1,4 @@
-FROM golang:1.26.5-bookworm AS agentbuild
+FROM golang:1.26.10-bookworm AS agentbuild
 ENV GOTOOLCHAIN=local
 WORKDIR /go/src/github.com/nudgebee/application-profiler
 COPY . /go/src/github.com/nudgebee/application-profiler
@@ -11,7 +11,8 @@ RUN apk add --no-cache git  \
     && git clone https://github.com/brendangregg/FlameGraph
 
 FROM alpine:3.23.4
-RUN apk add --no-cache perf perl procps \
+RUN apk upgrade --no-cache  \
+    && apk add --no-cache perf perl procps \
     && mkdir -p /app/FlameGraph
 COPY --from=agentbuild /go/bin/agent /app/agent
 RUN mv /usr/bin/perf /app/perf

docker/python/Dockerfile

@@ -1,4 +1,4 @@
-FROM golang:1.26.5-alpine AS agentbuild
+FROM golang:1.26.10-alpine AS agentbuild
 ENV GOTOOLCHAIN=local
 WORKDIR /go/src/github.com/nudgebee/application-profiler
 COPY . /go/src/github.com/nudgebee/application-profiler
@@ -16,8 +16,11 @@ RUN pip3 install py-spy==0.4.2  \
     && apt-get update && apt-get install -y git \
     && git clone https://github.com/brendangregg/FlameGraph
 
-FROM python:3.14.0-alpine
-RUN apk add --update --no-cache perl procps strace  \
+FROM python:3.14.10-alpine
+# apk upgrade first: apk add only updates the packages it names, so base
+# packages such as openssl would otherwise stay at the image's build-time level.
+RUN apk upgrade --no-cache  \
+    && apk add --no-cache perl procps strace  \
     && mkdir -p /app/FlameGraph
 COPY --from=pyspybuild /FlameGraph /app/FlameGraph
 COPY --from=agentbuild /go/bin/agent /app/agent
@@ -27,7 +30,10 @@ COPY --from=agentbuild /go/src/github.com/nudgebee/application-profiler/contrib/
 # target is reported as "not a Python process". It only writes the binary MOJO
 # format, so austin-python comes along for mojo2austin, which converts it back
 # to the text format the raw artefact and flamegraph.pl are built around.
-RUN pip3 install austin-dist==4.0.0 austin-python==1.7.1
+# pip is dropped afterwards: nothing runs it at profile time, and its vendored
+# copies of setuptools and urllib3 carry CVEs that ship with the image otherwise.
+RUN pip3 install --no-cache-dir austin-dist==4.0.0 austin-python==1.7.1  \
+    && pip3 uninstall -y pip
 RUN chmod +x /app/get-ps-command.sh
 
 CMD [ "/app/agent" ]

docker/ruby/Dockerfile

@@ -1,4 +1,4 @@
-FROM golang:1.26.5-bookworm AS agentbuild
+FROM golang:1.26.10-bookworm AS agentbuild
 ENV GOTOOLCHAIN=local
 WORKDIR /go/src/github.com/nudgebee/application-profiler
 COPY . /go/src/github.com/nudgebee/application-profiler
@@ -13,8 +13,11 @@ RUN git clone https://github.com/brendangregg/FlameGraph  \
 WORKDIR /rbspy
 RUN cargo build --release
 
-FROM bitnami/minideb:bookworm
+# trixie, not bookworm: bookworm leaves zlib CVE-2023-45853 unfixed. rbspy and
+# the agent are built against bookworm's older glibc, which runs on trixie's.
+FROM bitnami/minideb:trixie
 RUN apt-get update  \
+    && apt-get upgrade -y  \
     && apt-get install -y procps strace  \
     && apt-get clean \
     && mkdir -p /app/FlameGraph

test/e2e/go-pprof.sh

@@ -61,7 +61,7 @@ func main() {
 }
 GO
 cat >"$work/Dockerfile" <<'DOCKERFILE'
-FROM golang:1.26.5-alpine AS build
+FROM golang:1.26.10-alpine AS build
 WORKDIR /src
 COPY main.go .
 RUN go mod init example.com/server && CGO_ENABLED=0 go build -o /server .