You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
fix(web): upgrade expat, musl and zlib in the web image - #845
Master's publish-edge job "build & push edge image (web)" fails the Trivy scan on both architectures (run 42389380223). There are 7 HIGH CVEs, all with fixes available, and they all come from packages in the nginxinc/nginx-unprivileged:1.31-alpine base image:
web/Dockerfile now adds these four packages to the apk add line that #816 introduced, with the fixed versions as minimums. That line already runs as root and then switches back to uid 101. I checked the Alpine 3.24 main APKINDEX: it has libexpat 2.10.0-r0, musl/musl-utils 1.2.6-r3 and zlib 1.4-r0.
The scan gate is unchanged. Once the base image is rebuilt upstream, the pins can be removed.
Master's publish-edge Trivy scan fails the web image on 7 fixed HIGH
CVEs shipped by nginxinc/nginx-unprivileged:1.31-alpine:
libexpat 2.9.0-r0 (CVE-2026-113351, -115506, -117610, -118370),
musl/musl-utils 1.2.6-r2 (CVE-2026-107891) and zlib 1.3.2-r0
(CVE-2026-85091). Add them to the existing apk upgrade line with the
Alpine 3.24 fixed versions as minimums.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Claude <noreply@anthropic.com>
No actionable comments were generated in the recent review.
Walkthrough
The web Dockerfile now upgrades additional vulnerable Alpine packages, alongside brotli and curl/libcurl. It continues to switch back to the unprivileged nginx user after installation.
Changes
Web image package upgrades
Layer / File(s)
Summary
Upgrade vulnerable image packages web/Dockerfile
The package installation adds fixed versions of libexpat, musl, musl-utils, and zlib. The existing brotli and curl/libcurl upgrades remain. The Dockerfile still switches back to UID 101 after installation.
Reviewing files that changed from the base of the PR and between 938a63c and 1bca7a4.
Files selected for processing: 1
web/Dockerfile
Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.
Learnt from: CR
Repo: GameplanePanel/Gameplane PR: 0
File: docs/contributing.md:0-0
Timestamp: 2026-11-03T19:14:22.430Z
Learning: Applicability reference:
AGENTS.md: # Gameplane — AI assistant guide
Architecture, commands, and binding rules for AI agents. Humans: [`README.md`](README.md), [`docs/contributing.md`](docs/contributing.md).
AGENTS.md: # Gameplane — AI assistant guide
## Commands (via Makefile; compile checks excepted, see rule 8)
- **Dev containers:** `make devcontainers` (regenerate every profile and the `website/` and `modules/` copies after editing `.devcontainer/versions.toml`, `.devcontainer/profiles.toml`, `.devcontainer/devcontainer-lock.json`, `.devcontainer/setup.sh` or a `system-deps.toml`), `make check-devcontainers` (drift check). Profile table: `docs/contributing.md`.
Source excerpt:
# Contributing
## CI and workflows
### Security and drift gates
- **`workflow lint`** also runs hadolint over every tracked Dockerfile, failing on any warning (`.hadolint.yaml`). Fix the Dockerfile: pin `apk`/`apt` package versions, and set a `SHELL` with `-o pipefail` before any piped `RUN` step.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
ValgulNecron
added
type: security
Claude
Why
Master's publish-edge job "build & push edge image (web)" fails the Trivy scan on both architectures (run 42389380223). There are 7 HIGH CVEs, all with fixes available, and they all come from packages in the
nginxinc/nginx-unprivileged:1.31-alpinebase image:What
web/Dockerfilenow adds these four packages to theapk addline that #816 introduced, with the fixed versions as minimums. That line already runs as root and then switches back to uid 101. I checked the Alpine 3.24 main APKINDEX: it has libexpat 2.10.0-r0, musl/musl-utils 1.2.6-r3 and zlib 1.4-r0.The scan gate is unchanged. Once the base image is rebuilt upstream, the pins can be removed.
🤖 Generated with Claude Code
Summary by CodeRabbit