fix: remediate openssl CVE-2026-63073 / CVE-2026-75803 in container image

[independabot-soc2]

Summary

Fixes two CRITICAL openssl CVEs in the published container image by pinning the runtime apk install step to openssl>=3.5.8-r0.

Affected image

• Canonical URI: us-east4-docker.pkg.dev/astral-field-294621/warp-public-images/oz-agent-worker
• Digest: sha256:9999df83c1ff295afcbd5f8c058c45c899e3b20c2a52a13bafce29b3e26210a7
• Tags: latest, v2026-08-28-21-43-14

Vulnerabilities

• CVE-2026-63073 (CRITICAL, CVSS 9.8) — https://security.alpinelinux.org/vuln/CVE-2026-63073 — SLA 2026-09-10
• CVE-2026-75803 (CRITICAL, CVSS 9.1) — https://security.alpinelinux.org/vuln/CVE-2026-75803 — SLA 2026-09-11
• Vanta finding IDs: 6a9674a91261712141f2b069, 6a97a99f702dfddf305395ba
• Vanta asset: projects/astral-field-294621/locations/us-east4/repositories/warp-public-images/packages/oz-agent-worker

Package change

• openssl: 3.5.7-r0 -> 3.5.8-r0 (also upgrades transitive libssl3/libcrypto3)

Fix

alpine:3.22 is a rolling tag, so a fresh build isn't guaranteed to pick up a
patched openssl from the base layer alone. The Dockerfile's runtime apk add
step now explicitly constrains openssl>=3.5.8-r0, so the build fails loudly
if the upstream Alpine 3.22 repo ever regresses below the fixed version instead
of silently shipping the vulnerable version.

Ownership evidence

.github/workflows/build_release.yml in this repo builds ./Dockerfile and
pushes to us-east4-docker.pkg.dev/astral-field-294621/warp-public-images/oz-agent-worker
(see the docker job / image-tags step), matching the affected image's
canonical URI exactly.

Validation

• docker build -t oz-agent-worker-test . — succeeds.
• Confirmed inside the built image: apk info -v shows openssl-3.5.8-r0,
  libssl3-3.5.8-r0, libcrypto3-3.5.8-r0.
• No Go source changed; go.mod/go.sum/code untouched, so CI's lint/test/build/helm
  jobs are unaffected by this change.
• GCP Artifact Registry scanning and Vanta were not available to this worker
  (no GCP/Vanta credentials). Repository checks and package/advisory evidence
  pass. Vanta confirmation remains asynchronous after this image is rebuilt
  and deployed via Build Release.

Rollout

Merge and run the Build Release workflow (or let the next scheduled build
run) to publish a new image tag with the fix, then verify the Vanta finding
clears after rescan.

Co-Authored-By: Warp agent@warp.dev