From 15e530e0ef1b66b78e7673667ffc0ec024fb6177 Mon Sep 17 00:00:00 2001 From: Oto Macenauer Date: Fri, 6 Nov 2026 12:14:51 +0100 Subject: [PATCH] fix: patch base image CVEs and let Dependabot track it The image scan failed on CVE-2026-111497 (critical, brotli-libs 1.2.0-r0, fixed in 1.2.1-r0). The pinned nginx-unprivileged:1.29-alpine tag has not been rebuilt upstream since May, and even the current 1.31-alpine still ships the vulnerable package; Alpine has the fix. - Bump the base to nginx-unprivileged:1.31-alpine (Alpine 3.24), pinned by digest. - Run `apk upgrade --no-cache` as root, then drop back to UID 101, so Alpine security fixes land without waiting for an upstream rebuild. - Add the docker ecosystem to Dependabot. The Dockerfile already said Dependabot bumps the tag, but nothing did, which is how the base went stale. Co-Authored-By: Claude Opus 5.5 --- .github/dependabot.yml | 10 +++++++++- Dockerfile | 10 +++++++++- 2 files changed, 18 insertions(+), 2 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 8c28212..cba9247 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -1,4 +1,5 @@ -# Dependabot keeps npm dependencies and pinned GitHub Actions up to date. +# Dependabot keeps npm dependencies, pinned GitHub Actions and the Docker base +# image up to date. # Action updates land as SHA bumps with the human-readable tag in a comment. version: 2 updates: @@ -17,3 +18,10 @@ updates: schedule: interval: weekly open-pull-requests-limit: 5 + + # The Dockerfile pins nginx-unprivileged by tag and digest; this bumps both. + - package-ecosystem: docker + directory: / + schedule: + interval: weekly + open-pull-requests-limit: 5 diff --git a/Dockerfile b/Dockerfile index 245d090..69b3752 100644 --- a/Dockerfile +++ b/Dockerfile @@ -8,7 +8,15 @@ # Pinned by digest, matching how every GitHub Action in .github/workflows is # pinned. Dependabot bumps the tag; the digest keeps the deployment from moving # underneath it in the meantime. -FROM nginxinc/nginx-unprivileged:1.29-alpine@sha256:0c79d56aee561a1d81c63f00eee5fb5fe29279560cdc55e91425133104c7fbe6 AS runtime +FROM nginxinc/nginx-unprivileged:1.31-alpine@sha256:b5047b9b76845eac124358373c6852377c52e4b05834a47647e955dd91cb8f1e AS runtime + +# Apply Alpine security fixes released since the base image was built. The +# digest pin keeps nginx itself fixed, but upstream rebuilds only every few +# weeks, and a CVE fixed in an Alpine package fails the Trivy scan until then. +# The image runs as UID 101, so switch to root for the upgrade and back after. +USER root +RUN apk upgrade --no-cache +USER 101 # Overwrite the stock config rather than `RUN rm`-ing it: this image drops to a # non-root user, which cannot delete files under /etc/nginx.