admin/accounted
3
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

fix(docker): bump node:22-alpine digest so the frozen apk-upgrade layer re-runs (CVE-2026-14456) (#2071)

Browse Source 
The scheduled image scan has been red since 2026-08-30 on fixable HIGH CVE-2026-14456 (libssl3/libcrypto3 3.5.7-r0, fixed 3.5.8-r0). Both Dockerfile stages already run apk upgrade, but the GHCR buildx layer cache freezes that layer, so post-pin fixes never reach the published image. Bumping the pinned FROM digest (alpine 3.23 to 3.24.1) busts the cache and the re-run upgrade installs 3.5.8-r0 (verified in both new bases). cron.Dockerfile gains the same apk upgrade line.
This commit is contained in:
Jakob Wennberg
2026-08-31 09:58:55 +01:00
committed by GitHub
parent 502905e093
commit dd7a2eab5f
3 changed files with 8 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docker/cron.Dockerfile
+5 -1
View File
@@ -11,7 +11,11 @@ ARG SUPERCRONIC_SHA256_AMD64=feefa310da569c81b99e1027b86b27b51e6ee9ab647747b4909
ARG SUPERCRONIC_SHA256_ARM64=f1f8585c66de020fef494dd636058f99949d108f569fef00016a1c8b9eb145b3
# curl stays in the image: the crontab uses it at runtime to call the app.
RUN apk add --no-cache curl \
# `apk upgrade` first: it patches OS packages (e.g. libssl3/libcrypto3) that
# have fixes published after the pinned base digest was built, same rationale
# as the main Dockerfile. The digest stays pinned; only security patches float.
RUN apk upgrade --no-cache \
&& apk add --no-cache curl \
&& case ${TARGETARCH} in \
amd64) ARCH=linux-amd64; SHA=${SUPERCRONIC_SHA256_AMD64} ;; \
arm64) ARCH=linux-arm64; SHA=${SUPERCRONIC_SHA256_ARM64} ;; \