[alnr]

The Docker image scan passes again. The runtime images now upgrade all installed Alpine packages, and the vulnerable Go modules are bumped to their first patched versions.

• .docker/Dockerfile-build (the image the scan checks) and .docker/Dockerfile-alpine (the -alpine release images) run apk upgrade --no-cache instead of upgrading only libssl3/libcrypto3.
• google.golang.org/grpc v1.83.2 (GHSA-2v4p-qf9q-27wj)
• github.com/getkin/kin-openapi v0.149.0 (GHSA-rj39-cv6w-8wv7, GHSA-g8cf-rcjf-c8cf, GHSA-vrcc-3ch7-hppw)
• golang.org/x/net v0.62.0 (GO-2026-6860, GO-2026-6866)
• golang.org/x/crypto v0.59.0 (GO-2026-5932)

Only golang.org/x/* modules moved along with these; no ory/* modules changed.

Related Issue or Design Document

The docker job of the Docker Image Scan fails on findings rated critical, such as in https://github.com/ory/cli/actions/runs/43060567941/job/130661697455?pr=466. The critical finding is zlib 1.3.2-r1 (CVE-2026-4738) from the Alpine base image. zlib 1.4-r0 is already in the Alpine 3.22 and 3.24 repositories, but the base images have not been rebuilt with it, and the Dockerfiles upgraded only the OpenSSL libraries.

Both images, scanned with grype v0.110.0 and the flags of the workflow, now exit 0 and contain zlib 1.4-r0. ory dev openapi migrate, which uses kin-openapi and has no tests, produces byte-identical output before and after the bump.

The scan still reports two findings without a fix; neither fails the job:

• github.com/go-jose/go-jose/v3 (GHSA-mgcc-cww5-fp2q, GHSA-vvm8-gf78-28g4, GHSA-4w3g-jfj2-cw2q): there is no patched v3 release, only v4 ≥ 4.1.6. Besides cmd/cloudx/proxy, ory/hydra/v2/cmd and ory/x/jwksx link v3, and both pin v3.0.5 on master, so clearing it needs ory/x and hydra to move to v4 first.
• busybox CVE-2025-60876: Alpine has not shipped a fix.

Checklist

• I have read the contributing guidelines
  and signed the CLA.
• I have referenced an issue containing the design document if my change
  introduces a new feature.
• I have read the security policy.
• I confirm that this pull request does not address a security
  vulnerability. If this pull request addresses a security vulnerability, I
  confirm that I got approval (please contact
  security@ory.com) from the maintainers to push
  the changes.
• I have added tests that prove my fix is effective or that my feature
  works.
• I have added the necessary documentation within the code base (if
  appropriate).

🤖 Generated with Claude Code

https://claude.ai/code/session_01DUBUDtBsoC8hPjW2z7atVc

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 9 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: b32c88e5-cc6e-4704-b97b-d9dff20c510a

Commits

Reviewing files that changed from the base of the PR and between 1909f84 and c7c779f.

Files ignored due to path filters: 1

• go.sum is excluded by !**/*.sum

Files selected for processing: 3

• .docker/Dockerfile-alpine
• .docker/Dockerfile-build
• go.mod

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn