From 5dae362479c8d64f5a950349c3b3eb4f1b566645 Mon Sep 17 00:00:00 2001 From: Fajrian Aidil Pratama Date: Tue, 16 Jun 2026 10:31:06 +0800 Subject: [PATCH] fix(docker): bump alpine runtime base to clear libcrypto3 CVE-2026-31789 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps the runtime stage FROM alpine:3.21 → alpine:3.22 to clear the CRITICAL libcrypto3/libssl3 CVE-2026-31789 (heap buffer overflow) and all associated HIGH-severity OpenSSL/musl/zlib CVEs present in the stale alpine:3.21.6 base baked into the current image. Trivy before (ghcr.io/banua-coder/pico-api-go:latest, alpine 3.21.6): CRITICAL: 2 (CVE-2026-31789 libcrypto3 + libssl3) HIGH: 11 (alpine OS layer) Trivy after (alpine:3.22 base): CRITICAL: 0 HIGH: 2 (CVE-2026-45447, different issue, fixed version available) — CVE-2026-31789 is absent from alpine:3.22 Fixes: d8a7 --- Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index cc220db..97194f3 100644 --- a/Dockerfile +++ b/Dockerfile @@ -16,7 +16,7 @@ RUN CGO_ENABLED=0 GOOS=linux go build \ ./cmd/ # ---- Runtime image ---- -FROM alpine:3.21 +FROM alpine:3.22 RUN apk --no-cache add ca-certificates tzdata