From 2d9ea54b8906e55feb9542c7cd09eaeedcb939e9 Mon Sep 17 00:00:00 2001 From: Claude Date: Sat, 31 Oct 2026 00:22:02 +0000 Subject: [PATCH] fix(web): upgrade brotli-libs and curl in the dashboard image publish-edge on master (run 41107014011) fails the Trivy gate on the web image only. The nginx-unprivileged:1.31-alpine base (last rebuilt 2026-10-19) ships brotli-libs 1.2.0-r1 (CVE-2026-111497, CRITICAL) and curl/libcurl 8.22.0-r0 (CVE-2026-92392, HIGH). Alpine 3.24 has the fixed 1.2.1-r0 and 8.23.0-r0, so install them as root and switch back to uid 101. Co-Authored-By: Claude Opus 5.5 Signed-off-by: Claude --- web/Dockerfile | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/web/Dockerfile b/web/Dockerfile index 06af8a8ba..3b2c7d46a 100644 --- a/web/Dockerfile +++ b/web/Dockerfile @@ -55,6 +55,14 @@ LABEL org.opencontainers.image.version="${VERSION}" # default keeps a bare `docker run` from failing to start. ENV API_UPSTREAM=http://gameplane-api.gameplane-system.svc.cluster.local +# The base image (last rebuilt 2026-10-19) ships brotli-libs 1.2.0-r1 +# (CVE-2026-111497) and curl/libcurl 8.22.0-r0 (CVE-2026-92392); Trivy fails +# the publish on both. Upgrade them to the Alpine 3.24 fixes as root, then drop +# back to the base image's unprivileged nginx user (uid 101). +USER root +RUN apk add --no-cache brotli-libs~=1.2.1 curl~=8.23.0 libcurl~=8.23.0 +USER 101 + # Replace the base image's default server block with ours. RUN rm -f /etc/nginx/conf.d/default.conf COPY web/nginx.conf.template /etc/nginx/templates/gameplane.conf.template