[supabase-cli-releaser]

Pins packages/stack/src/Artifacts.ts to the
postgres 15.14.1.175
slim-services release and its image digest.

Opened from the mirror-slim-image dispatch. artifactFor derives the
native release tag, asset names, and URLs from service + version, so this
pin is the whole change.

[depthfirst-app]

🟡 Severity: MEDIUM

This selected image is PostgreSQL 15.14, affected by CVE-2026-2003, CVE-2026-2004, CVE-2026-2005, and CVE-2026-2006. An untrusted database user/object creator can supply crafted inputs to server paths, reaching memory-disclosure or memory-corruption sinks and potentially executing code as the database OS account. Advisories
Helpful? Add 👍 / 👎

💡 Fix Suggestion

Suggestion: Upgrade the pinned PostgreSQL 15 image from version 15.14.1.175 to a version based on PostgreSQL 15.16 or later to remediate CVE-2026-2003, CVE-2026-2004, CVE-2026-2005, and CVE-2026-2006. Check the ghcr.io/supabase/cli/postgres registry (or the supabase/postgres GitHub releases) for the latest 15.x slim-services build that corresponds to PostgreSQL ≥ 15.16, retrieve its image digest (docker buildx imagetools inspect ghcr.io/supabase/cli/postgres:<new-tag>), then replace both the version key ("15.14.1.175") and the image reference (including the @sha256:… digest) in the additionalImages object on lines 78-80 of packages/stack/src/Artifacts.ts.

[depthfirst-app]

🟡 Severity: MEDIUM

The selected image also supplies pg_dump, pg_dumpall, and psql; PostgreSQL’s advisories mark 17.x before 17.11 as affected by CVE-2026-19385 and CVE-2026-18408. A database object creator or malicious dump reaches these clients through crafted metadata/commands and can execute code as the local CLI user. CVE-2026-19385 CVE-2026-18408
Helpful? Add 👍 / 👎

💡 Fix Suggestion

Suggestion: Upgrade the pinned PostgreSQL image from 17.9.0.028-orioledb to a version that includes PostgreSQL 17.11 or later, which contains the patches for CVE-2026-19385 and CVE-2026-18408. Specifically:

1. Check ghcr.io/supabase/cli/postgres for the latest orioledb-flavored release that bundles PostgreSQL >= 17.11 (e.g., a tag in the form 17.11.x.xxx-orioledb).
2. Update line 74 (defaultVersion) from "17.9.0.028-orioledb" to the new version string.
3. Update line 75 (the image reference) to the new tag and its corresponding @sha256:<digest> pin, ensuring the digest is fetched from the registry (e.g., via docker manifest inspect ghcr.io/supabase/cli/postgres:<new-tag>) to maintain supply-chain integrity.