From 417f38d1d8d232ab812f1ff0bf3c0d56a6c6843f Mon Sep 17 00:00:00 2001 From: TheMeinerLP Date: Sat, 17 Oct 2026 21:50:43 +0200 Subject: [PATCH] fix(docker): upgrade libexpat in the dashboard image The pinned nginx-unprivileged 1.31-alpine base ships libexpat 2.8.5-r0, which is affected by CVE-2026-77214 (HIGH), fixed in 2.9.0-r0. The base digest for this tag has no fixed build yet, so upgrade just libexpat in the run stage. The step runs as root only for the upgrade and switches back to the unprivileged user 101 immediately after. --- reposilite-frontend/Dockerfile | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/reposilite-frontend/Dockerfile b/reposilite-frontend/Dockerfile index 4b7479948..0938e3383 100644 --- a/reposilite-frontend/Dockerfile +++ b/reposilite-frontend/Dockerfile @@ -56,6 +56,14 @@ RUN set -eu; \ # starting as root and dropping privileges the way the stock nginx image does. FROM nginxinc/nginx-unprivileged:1.31-alpine@sha256:378d0c32f6562f7fd9629170797f57d2b953aa09be983b3daaf4809bb039ca00 AS run +# The pinned base still ships libexpat 2.8.5 (CVE-2026-77214, fixed in 2.9.0). Upgrade just +# that package, as root for the duration of this step only, then drop back to the unprivileged +# user the base image runs as. Remove this once the base image carries the fixed version. +USER root +RUN apk upgrade --no-cache libexpat \ + && apk info -v libexpat +USER 101 + # Where to reach the server, and how to resolve it. 127.0.0.11 is Docker's embedded DNS; on # Kubernetes this wants the cluster resolver instead. ENV INGOT_BACKEND="http://ingot-backend:8080" \