[haukened]

Name of feature:

A vulnerability fix for the Docker images. Nothing changes in how they work.

Pain or issue this feature alleviates:

The alpine, cloud and debian images all build FROM smallstep/step-cli, which only gets rebuilt when the CLI releases. Anything Alpine or Debian patched since then ships unpatched. This adds apk upgrade --no-cache (or apt-get upgrade -y) to the runtime stage, the same way the step-cli Dockerfiles already do it. Dockerfile.wolfi is untouched.

Why is this important to the project (if not answered above):

I've been working through the scanner findings in smallstep/step-ca:0.30.2, and the plugin turned out to be a big piece of it. step-ca copies its plugin out of step-kms-plugin:cloud, and Xray pins 93 of the 231 findings in step-ca on that binary.

Here's the thing though: main is already clean. Dependabot has bumped every affected module since v0.17.0, and a rebuild picks up a current Go on its own. That release is from April 8 and was built with Go 1.26.2, and it's still what gets published and what step-ca bundles. So the most useful thing here honestly isn't this PR, it's a release before the end-of-November step-ca release. That alone clears all of it out of step-ca.

What this PR does to the images:

image	OS findings: published → this branch	Go findings: published → this branch
0.17.0 (alpine)	225 → 0	176 → 2
trixie	817 → 447	176 → 2

The 2 left on the Go side are the x/crypto/openpgp deprecation notice (GO-2026-5932), once each for step and the plugin. The plugin doesn't import openpgp, and govulncheck says it's never called. The only fix is x/crypto v0.59.0, which also drops DSA and rejects SSH certs without principals, so I left that one for you and Dependabot. The 447 on trixie are all affected or fix_deferred on Debian's end - nothing to upgrade to yet.

Is there documentation on how to use this feature? If so, where?

N/A - same user, CMD and packages as before.

In what environments or workflows is this feature supported?

• Built all three images on top of the companion cli branch. Each one runs as step, reports the right versions, and can sign through step kms sign.
• The cloud image is the one step-ca copies from. The step-ca image built on it passes first-run init, health, issuing certs and step kms, on both amd64 and 386.
• Ran your CI locally on Go 1.26 and 1.27: golangci-lint with your shared config, the generate and tidy checks, govulncheck, tests, cgo and non-cgo builds, and CodeQL. All green, and CodeQL comes back identical to main.

In what environments or workflows is this feature explicitly NOT supported (if any)?

None.

Supporting links/other PRs/issues:

• Companion PRs: Upgrade OS packages in images and bump pgx to v5.12.0 certificates#2854 (pgx bump + OS package upgrade in the images), Bump github.com/jackc/pgx/v5 to v5.12.0 cli#1737 (pgx bump)