Skip to content

fix(dockerfile): bump curl, remove pcre bump#2757

Merged
billhimmelsbach merged 1 commit intomasterfrom
5551-update-curl
May 5, 2026
Merged

fix(dockerfile): bump curl, remove pcre bump#2757
billhimmelsbach merged 1 commit intomasterfrom
5551-update-curl

Conversation

@billhimmelsbach
Copy link
Copy Markdown
Contributor

Right now on nginx:alpine3.23, curl has vulnerabilities that haven't made it into the newest release yet, at least in a way that prisma cloud is happy with.

It's a little tricky to update curl manually, but I think it's worth it for now (with a follow-up ticket GHE #5550 to remove this temporary patch down the road if we want to).

The update we need for curl is only in the alpine edge repository.

I'm also taking the moment to remove the pcre2 temporary fix, since it's been updated in the latest version of the docker image.

Changes

  • updates curl from the alpine edge repository (and their peer deps)
  • removes the old pcre2 patch that is no longer needed (prisma now passes without it)

Testing

  • Does this resolve the vulnerabilities to prisma's satisfaction? Yes!
hmda-frontend
  • Does it look good on staging? Yes!

@billhimmelsbach billhimmelsbach marked this pull request as ready for review May 5, 2026 11:38
@billhimmelsbach billhimmelsbach requested a review from contolini May 5, 2026 11:38
Copy link
Copy Markdown
Member

@contolini contolini left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It builds and stagin' lookin' good! 👍

@billhimmelsbach billhimmelsbach merged commit 622dd01 into master May 5, 2026
1 check passed
@billhimmelsbach billhimmelsbach deleted the 5551-update-curl branch May 5, 2026 19:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants