admin/accounted
3
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

fix(docker): bump node:22-alpine digest so the frozen apk-upgrade layer re-runs (CVE-2026-14456) (#2071)

Browse Source 
The scheduled image scan has been red since 2026-08-30 on fixable HIGH CVE-2026-14456 (libssl3/libcrypto3 3.5.7-r0, fixed 3.5.8-r0). Both Dockerfile stages already run apk upgrade, but the GHCR buildx layer cache freezes that layer, so post-pin fixes never reach the published image. Bumping the pinned FROM digest (alpine 3.23 to 3.24.1) busts the cache and the re-run upgrade installs 3.5.8-r0 (verified in both new bases). cron.Dockerfile gains the same apk upgrade line.
This commit is contained in:
Jakob Wennberg
2026-08-31 09:58:55 +01:00
committed by GitHub
parent 502905e093
commit dd7a2eab5f
3 changed files with 8 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Dockerfile
+2 -2
View File
@@ -1,5 +1,5 @@
# ── Stage 1: Base ──
FROM node:22-alpine@sha256:968df39aedcea65eeb078fb336ed7191baf48f972b4479711397108be0966920 AS base
FROM node:22-alpine@sha256:c610fcdfb1d5b4740dd70c284ed3cb16bb857e0f7166196e36a5501df7a3aa32 AS base
# `apk upgrade` patches OS packages (e.g. libssl3/libcrypto3) that have fixes
# published after the pinned base digest was built, so the Trivy image scan in
# CI doesn't fail on fixable Alpine CVEs. The digest stays pinned for a
@@ -54,7 +54,7 @@ ENV NEXT_TELEMETRY_DISABLED=1
RUN npm run build
# ── Stage 4: Runner ──
FROM node:22-alpine@sha256:968df39aedcea65eeb078fb336ed7191baf48f972b4479711397108be0966920 AS runner
FROM node:22-alpine@sha256:c610fcdfb1d5b4740dd70c284ed3cb16bb857e0f7166196e36a5501df7a3aa32 AS runner
WORKDIR /app
# Patch OS packages (libssl3/libcrypto3, …) with fixes published after the