Refresh the container image to apply Alpine and runtime dependency security updates

[Feberdin]

Summary

The current public image contains Alpine runtime packages with available security updates.

• Image: ghcr.io/sufxgit/scoutarr:latest
• Digest: sha256:8c45d41cdc3ac999255aa59137fb157903be2613bab404dec6805f4ad3fac1fe
• Image creation timestamp: 2026-04-09T14:02:50.890471537+03:00
• Base distribution: Alpine 3.23.2

This is a container package-maintenance report. No Scoutarr application-level exploitability is claimed.

Reproduction

Inspect the public artifact at the digest above with current vulnerability databases. Trivy 0.73.0 and Grype 0.116.1 corroborate the affected package/version pairs. The highest-signal fixed-version findings are:

Package	Installed	Fixed version	Advisories
libcrypto3, libssl3	3.5.4-r0	3.5.6-r0 or newer	CVE-2026-31789 and related OpenSSL 3.5 fixes
libcrypto3, libssl3	3.5.4-r0	3.5.7-r0 or newer	CVE-2026-45447
musl, musl-utils	1.2.5-r21	1.2.5-r23 or newer	CVE-2026-40200

The image also contains JavaScript dependencies with fixed versions available, including axios 1.13.2, form-data 4.0.5, glob 10.4.5, and minimatch 9.0.5. Findings without a confirmed fixed version were intentionally excluded.

Suggested remediation

1. Rebuild from a current node:22-alpine base and refresh Alpine runtime packages.
2. Regenerate the production dependency lock/install so fixed JavaScript dependency versions are included.
3. Publish the resulting immutable image digest.
4. Re-scan the new digest and verify that the installed package versions have changed.