🔒️(docker) upgrade musl-utils to fix CVE-2026-107891

Update musl-utils in all alpine images
2026-11-08 20:01:51 +00:00 · 2026-11-06 22:59:52 +01:00
5 changed files with 7 additions and 4 deletions
@@ -35,6 +35,7 @@ and this project adheres to
 - 🐛(frontend) send users who cannot enter directly back to the lobby
 - 🔒️(backend) refuse unregistered rooms whose slug is a UUID
 - 🔒️(agents) upgrade python to 3.14.10 to fix CVE-2026-109518
+- 🔒️(docker) upgrade musl-utils to 1.2.6-r3 to fix CVE-2026-107891
 - ♿️(frontend) close the invite dialog with the Escape key #1916

 ## [1.37.0] - 2026-11-01
@@ -9,7 +9,8 @@ RUN python -m pip install --upgrade pip
 # Upgrade system packages to install security updates
 RUN apk update && \
  apk upgrade && \
-  apk add --no-cache --upgrade 'ca-certificates>=20261020-r0' && \
+  apk add --no-cache --upgrade 'ca-certificates>=20261020-r0' \
+    'musl-utils>=1.2.6-r3' && \
  update-ca-certificates

 # ---- Back-end builder image ----
@@ -64,7 +64,7 @@ USER root
 RUN apk upgrade --no-cache libexpat && \
    apk add --no-cache --upgrade 'pcre2>=10.49-r0' 'tiff>=4.7.2-r0' \
        'libx11>=1.8.14-r0' 'ca-certificates>=20261020-r0' \
-        'brotli-libs>=1.2.1-r0' && \
+        'brotli-libs>=1.2.1-r0' 'musl-utils>=1.2.6-r3' && \
    apk del curl && \
    rm -f /usr/share/nginx/html/50x.html
 USER nginx
@@ -53,7 +53,7 @@ USER root
 RUN apk upgrade --no-cache libexpat && \
    apk add --no-cache --upgrade 'pcre2>=10.49-r0' 'tiff>=4.7.2-r0' \
        'libx11>=1.8.14-r0' 'ca-certificates>=20261020-r0' \
-        'brotli-libs>=1.2.1-r0' && \
+        'brotli-libs>=1.2.1-r0' 'musl-utils>=1.2.6-r3' && \
    apk del curl && \
    rm -f /usr/share/nginx/html/50x.html
 USER nginx
@@ -1,6 +1,7 @@
 FROM python:3.13.16-alpine3.24 AS base

-RUN apk add --no-cache --upgrade 'ca-certificates>=20261020-r0'
+RUN apk add --no-cache --upgrade 'ca-certificates>=20261020-r0' \
+    'musl-utils>=1.2.6-r3'


 # Install ffmpeg for audio/video processing (format conversion, extraction, compression)