This is an automated email from the ASF dual-hosted git repository.
klesh pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/devlake.git
The following commit(s) were added to refs/heads/main by this push:
new c63d21d44 fix(docker): upgrade OS packages in release images (#9264)
c63d21d44 is described below
commit c63d21d449aca249eb3d2e4947ce62497547b805
Author: Dirk <[email protected]>
AuthorDate: Wed Oct 28 09:34:18 2026 +0100
fix(docker): upgrade OS packages in release images (#9264)
The base images still ship a Brotli library that is vulnerable to
CVE-2026-111497 (critical, CVSS 9.2). New base tags do not fix it yet:
nginx-unprivileged 1.31.7 still has libbrotli1 1.1.0-2+b7 and
grafana 13.2.4 still has brotli-libs 1.2.0-r1.
Upgrade the OS packages at build time in all three images:
- backend: apt-get upgrade (libbrotli1 1.0.9-2+deb12u1)
- config-ui: apt-get upgrade (libbrotli1 1.1.0-2+deb13u1)
- grafana: apk upgrade (brotli-libs 1.2.1-r0)
Closes #9258
---
backend/Dockerfile | 2 ++
config-ui/Dockerfile | 7 ++++++-
grafana/Dockerfile | 4 +++-
3 files changed, 11 insertions(+), 2 deletions(-)
diff --git a/backend/Dockerfile b/backend/Dockerfile
index cd354085d..b85a5ec8d 100644
--- a/backend/Dockerfile
+++ b/backend/Dockerfile
@@ -118,7 +118,9 @@ RUN cd /usr/local/deps/target/lib && \
FROM python:3.11-slim-bookworm as base
+# apt-get upgrade picks up Debian security fixes that the base tag does not
contain yet
RUN apt-get update && \
+ apt-get upgrade -y && \
apt-get install -y python3-dev python3-pip tar pkg-config curl libssh2-1
zlib1g libffi-dev default-libmysqlclient-dev libpq-dev tini git openssh-client
corkscrew && \
apt-get clean && \
rm -fr /usr/share/doc/* \
diff --git a/config-ui/Dockerfile b/config-ui/Dockerfile
index 5a017cc63..f5f692529 100644
--- a/config-ui/Dockerfile
+++ b/config-ui/Dockerfile
@@ -41,7 +41,12 @@ WORKDIR /usr/share/nginx/html
RUN rm -rf ./*
COPY --from=builder /home/node/code/dist/. ./
EXPOSE 4000 4443
-RUN apt update && apt install -y apache2-utils iproute2
+# apt-get upgrade picks up Debian security fixes that the base tag does not
contain yet
+RUN apt-get update && \
+ apt-get upgrade -y && \
+ apt-get install -y apache2-utils iproute2 && \
+ apt-get clean && \
+ rm -rf /var/lib/apt/lists/*
COPY --from=builder /home/node/code/nginx.sh /usr/bin/nginx.sh
RUN chmod +x /usr/bin/nginx.sh
RUN chgrp -R 0 /etc/nginx /var/log/nginx /usr/share/nginx /run && \
diff --git a/grafana/Dockerfile b/grafana/Dockerfile
index 1539b5b7a..913b3e766 100644
--- a/grafana/Dockerfile
+++ b/grafana/Dockerfile
@@ -37,8 +37,10 @@ ENV GF_SERVER_PROTOCOL=http
ENV GF_SERVER_DOMAIN=localhost:3000
ENV GF_SERVER_ROOT_URL=http://localhost:3000/grafana
USER root
+# apk upgrade picks up Alpine security fixes that the base tag does not
contain yet
# grafana-piechart-panel removed: dashboards use the core "piechart" panel type
-RUN chmod +x /entrypoint.sh && \
+RUN apk upgrade --no-cache && \
+ chmod +x /entrypoint.sh && \
chgrp -R 0 /etc/grafana /usr/share/grafana /var/lib/grafana && \
chmod -R g=u /etc/grafana /usr/share/grafana /var/lib/grafana
USER 101
