gsadmin/sencho
1
0
Fork 0
mirror of https://github.com/Studio-Saelix/sencho.git synced 2026-09-04 14:45:41 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(docker): install Docker CLI v29.3.1 from static binaries to resolve CVEs (#268)

Browse Source 
Alpine 3.23 ships docker-cli 29.1.3 which contains unpatched vulnerabilities:
- CVE-2026-33186 (Critical): gRPC-Go authorization bypass
- CVE-2026-34040 (High): Moby AuthZ plugin bypass
- CVE-2026-33747 (High): BuildKit path traversal via frontend
- CVE-2026-33748 (High): BuildKit path traversal via git URL

Replace apk-based docker-cli and docker-cli-compose with official static
binaries (Docker CLI v29.3.1 + Compose v2.40.3) pinned via build args.
This commit is contained in:
Anso
2026-03-29 23:28:55 -04:00
committed by GitHub
parent 8eff3fe876
commit f9b86e6f53
2 changed files with 19 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
CHANGELOG.md
+1
View File
@@ -25,6 +25,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
* **docker:** upgrade base image from `node:20-alpine` to `node:22-alpine` (Node 22.22.2 on Alpine 3.23.3) to remediate 31 CVEs (1 Critical, multiple High/Medium/Low) flagged by Docker Scout against the previous `node:20-alpine` base.
* **docker:** add `apk upgrade --no-cache` to runtime stage to ensure all Alpine system packages are at their latest patched versions at build time.
* **deps:** force `dompurify` to 3.3.3 via npm overrides to resolve two Dependabot advisories (Mutation-XSS via Re-Contextualization and Cross-site Scripting) in the transitive dependency pulled by `monaco-editor`.
* **docker:** install Docker CLI v29.3.1 and Compose v2.40.3 from official static binaries instead of Alpine packages (which ship v29.1.3) to resolve CVE-2026-33186 (Critical), CVE-2026-34040 (High), CVE-2026-33747 (High), CVE-2026-33748 (High), and bundled Go stdlib CVEs.
### Fixed