Nothing in container/Dockerfile pins a version (gh, docker-ce-cli and
Node come from their apt repos, pnpm/Playwright/uv/ruff/rustup/Claude
Code/AWS CLI resolve latest), so a rebuild is what delivers fixes. Two
things stood in the way:
- `apt-get install` never upgrades packages the ubuntu:24.04 image
already ships, so a noble-security fix stays out until Canonical
refreshes the tag. The first apt layer now runs `apt-get upgrade -y`
inside the existing retry pattern.
- CI builds with `cache-from: type=gha`, so the layers only re-run when
the base digest or a layer's text changes. Trivy on the published
image (built 2026-10-16) found libbrotli1 1.1.0-2build2
(CVE-2026-111497, HIGH), zlib1g 1.3.dfsg-3.1ubuntu2.2 (CVE-2026-85091)
and pnpm's bundled undici 6.29.0 (CVE-2026-109383, CVE-2026-109869,
CVE-2026-87018, all HIGH). Changing this layer invalidates the cache
once, so the next CI build rebuilds everything.
A local `docker build --pull` of this tree succeeds (amd64). Trivy finds
no fixable OS or Node vulnerabilities in it: Node 22.23.4, gh 2.103.3,
docker CLI 29.9.2, AWS CLI 2.39.3, pnpm 12.16.1, Playwright 1.64.1,
Claude Code 2.1.316. What remains is uv 0.13.6's bundled rustls 0.23.45
(GHSA-c8m5-c952-6cm4, MEDIUM). That is fixed on uv's main branch but not
in a release yet.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
shadowdaoandClaude Opus 5.5
77dca26a83