[BUG] Replace the end-of-support .NET 6.0.13 runtime in the current image

[Feberdin]

Is there an existing issue for this?

• I have searched the existing issues

Current Behavior

The self-contained Sonarr payload in the public image lscr.io/linuxserver/sonarr:latest at digest sha256:24acea2956a0ccb11f103877d9f4f8576600fb34bff34820ed749c2256dab89f includes .NET 6.0.13 and System.Text.Json 6.0.9.

Representative fixed versions are:

• Microsoft.AspNetCore.App.Runtime.linux-musl-x64 6.0.13: 6.0.20 or newer fixes CVE-2023-33170.
• Microsoft.NETCore.App.Runtime.linux-musl-x64 6.0.13: 6.0.18 or newer fixes CVE-2023-24936 and CVE-2023-29331; 6.0.32 or newer fixes CVE-2024-38095.
• System.Text.Json 6.0.9: 6.0.10 or newer fixes CVE-2024-43485.

.NET 6 is outside its support period. The image label is 4.0.19.2979-ls320 and its creation timestamp is 2026-07-18T00:18:00.559584995Z. This is a bundled runtime maintenance report; no Sonarr application-level exploitability is claimed.

Expected Behavior

The current public image should include a self-contained Sonarr payload built on a supported, security-patched .NET runtime.

Steps To Reproduce

1. Inspect the immutable public image digest listed above for the x86-64 platform.
2. Scan it with current vulnerability data.
3. Observe the embedded .NET 6.0.13 runtime and System.Text.Json 6.0.9.
4. Compare them with the fixed versions listed above.

The Dockerfile downloads the self-contained Sonarr release archive, so the runtime is part of that payload rather than a separately installed Alpine package.

Environment

• OS: Public image artifact; detected base is Alpine 3.24.1
• How docker service was installed: Not applicable; reproduction operates on the public registry artifact and does not require a running container

CPU architecture

x86-64

Docker creation

Not applicable; no container needs to be created to reproduce the embedded runtime versions.

Container logs

Not applicable; the finding is present in the immutable image layers before container startup.

Suggested remediation

1. Coordinate or consume a Sonarr release built on a currently supported .NET runtime.
2. Rebuild the image with that release archive.
3. Publish an immutable digest and verify that the old runtime components are absent.

[github-actions]

Thanks for opening your first issue here! Be sure to follow the relevant issue templates, or risk having this issue marked as invalid.

[Roxedus]

Dear sloperator(if this term made you feel things, it was the purpose), please read this post before letting your agents loose. A ban could follow.
https://www.linuxserver.io/blog/image-vulnerability-scanning-and-you

[Feberdin]

You are right. I should have verified component ownership and practical applicability, and I should have read the LinuxServer.io reporting guidance before opening multiple scanner-driven issues. That was my mistake. Sorry for the noise and the unnecessary triage work. I will not refile these findings here.