[ValgulNecron]

Why

publish-edge on master (run 41107014011, the #814 merge) fails the Trivy gate on the web image only; all other images pass. From the job log (both linux/amd64 and linux/arm64, Alpine 3.24.2):

Package	CVE	Severity	Installed	Fixed
brotli-libs	CVE-2026-111497	CRITICAL	1.2.0-r1	1.2.1-r0
curl	CVE-2026-92392	HIGH	8.22.0-r0	8.23.0-r0
libcurl	CVE-2026-92392	HIGH	8.22.0-r0	8.23.0-r0

All three come from the base image nginxinc/nginx-unprivileged:1.31-alpine, last rebuilt upstream on 2026-10-19, so re-running the job won't help. Alpine v3.24 already ships the fixed versions.

Change

web/Dockerfile final stage: switch to root, apk add --no-cache brotli-libs~=1.2.1 curl~=8.23.0 libcurl~=8.23.0 (pinned like tunnel/Dockerfile.playit, satisfies hadolint DL3018), then USER 101 back to the base image's unprivileged nginx user. No scan settings or ignore lists touched.

The upgrade can be dropped once upstream rebuilds 1.31-alpine with these versions.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Updated the application’s runtime environment with Brotli and curl support libraries. This is an infrastructure update and does not introduce a visible change to the app.

---

Generated by Claude Code

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: GameplanePanel/Gameplane
• Branch: fix/web-image-cves
• File: .coderabbit.yaml
• Commit: 2d9ea54
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: a28f336f-0460-4274-8859-7545c5dafb3f

Commits

Reviewing files that changed from the base of the PR and between 0becf8e and 2d9ea54.

Files selected for processing: 1

• web/Dockerfile

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

Recent review details

Context from checks skipped due to timeout: 4

• GitHub Check: move parity (spec 028)
• GitHub Check: detect changes
• GitHub Check: en-XA screenshots (spec 019)
• GitHub Check: design vs browser visual diff

Additional context used

Code guidelines: 2

AGENTS.md — auto-discovered
docs/architecture.md — auto-discovered

Path-based instructions: 2

Source excerpt: **Coverage minimums:** netguard 91, gameaction 91, gameproto 90, telemetryschema 90, i18n 90, gp-module 80, operator 72, api 80, agent 90, svcutil 90; audit-syslog-bridge, telemetry-receiver, sentinel, capture-sidecar, mcp-s...

CodeRabbit inference engine (AGENTS.md)

Files:

• web/Dockerfile

Applicability reference: AGENTS.md: # Gameplane — AI assistant guide `docs/architecture.md`, `docs/security.md` (threat model); `docs/module-authoring.md`; `mcp-server/README.md`; `audit-syslog-bridge/README.md`.

CodeRabbit inference engine (docs/architecture.md)

Files:

• web/Dockerfile

Additional comments: 1

web/Dockerfile: 1

63-63: Functional Correctness

The ~= operator in apk add cannot be decided from the available evidence. The verification environment does not have Docker, so the base image was not inspected. The claim depends on whether the apk-tools in nginxinc/nginx-unprivileged:1.31-alpine accepts ~= in a version constraint. The repository does not define that behavior.

Walkthrough

The nginx runtime image now installs pinned Brotli and curl packages as root, then switches back to uid 101.

Changes

Web runtime image

Layer / File(s)	Summary
Install runtime packages web/Dockerfile	The Dockerfile installs brotli-libs ~=1.2.1, curl ~=8.23.0, and libcurl ~=8.23.0 as root, then switches back to uid 101.

Estimated code review effort: 2 (Simple) | ~5 minutes

Change: Other

Suggested labels: type: fix, type: security, area: web

Merge Risk: Minimal · up to 2d9ea

The package upgrade has no identified merge-blocking risk.

Pre-merge checks: 4

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the upgrade of Brotli and cURL dependencies in the web dashboard image.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

CI Report - 2d9ea54

run 41149798563 - attempt 1

0 failed - 22 passed - 11 skipped - 32m46s elapsed

Test selection: partial - per-suite table

Coverage

Module	Measured	Gate	Margin
web	L95.87 S94.37 B89.27 F91.79	L92 S92 B82 F76	+2.37

Changed

Area	Files	+/-
web/	1	+8/-0

Slowest jobs

Job	Duration
build e2e images	17m25s
e2e web live / amd64 (kind)	14m7s
e2e web live / arm64 (kind)	11m3s
build e2e images (arm64)	10m58s
e2e postgres / amd64 (kind)	8m0s

e2e buckets run

api-agent, api-auth, api-mods, api-rbac, api-roles, management-placement, multicluster, operator, optional-components, telemetry, upgrade