From 10a50d30ccde65c8fe5100d91e749e65e6756dc2 Mon Sep 17 00:00:00 2001 From: Rick Bijkerk Date: Tue, 2 Jun 2026 12:04:54 +0200 Subject: [PATCH 1/2] fix: apply OS security updates to base images at build time The service, migrations and CLI Dockerfiles ran apt-get update followed only by apt-get install of a few specific packages, so Debian security patches inherited from the pinned node:*-slim base image were never applied. Add apt-get upgrade so published images pick up fixed OS packages at build time. --- .changeset/patch-base-image-os-packages.md | 5 +++++ docker/cli.dockerfile | 2 +- docker/migrations.dockerfile | 2 +- docker/services.dockerfile | 2 +- 4 files changed, 8 insertions(+), 3 deletions(-) create mode 100644 .changeset/patch-base-image-os-packages.md diff --git a/.changeset/patch-base-image-os-packages.md b/.changeset/patch-base-image-os-packages.md new file mode 100644 index 00000000000..680bc13395f --- /dev/null +++ b/.changeset/patch-base-image-os-packages.md @@ -0,0 +1,5 @@ +--- +'hive': patch +--- + +Apply OS security updates to the base image at build time by adding `apt-get upgrade` to the service, migrations, and CLI Dockerfiles. Previously these only ran `apt-get update` followed by `apt-get install` of a few specific packages, so Debian security patches inherited from the pinned `node:*-slim` base were never applied — leaving published images with known-fixed CVEs. Bumping the base image tag alone does not fix this, since the latest `node` tag can still lag behind Debian's security updates. \ No newline at end of file diff --git a/docker/cli.dockerfile b/docker/cli.dockerfile index 78c9ba0166e..bfd0bc51441 100644 --- a/docker/cli.dockerfile +++ b/docker/cli.dockerfile @@ -1,6 +1,6 @@ FROM node:24.14.1-slim -RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates git && rm -rf /var/lib/apt/lists/* +RUN apt-get update && apt-get upgrade -y && apt-get install -y --no-install-recommends ca-certificates git && rm -rf /var/lib/apt/lists/* ARG CLI_VERSION diff --git a/docker/migrations.dockerfile b/docker/migrations.dockerfile index 110cfd3c277..72d12407f33 100644 --- a/docker/migrations.dockerfile +++ b/docker/migrations.dockerfile @@ -1,6 +1,6 @@ FROM node:24.14.1-slim -RUN apt-get update && apt-get install -y ca-certificates +RUN apt-get update && apt-get upgrade -y && apt-get install -y ca-certificates && rm -rf /var/lib/apt/lists/* WORKDIR /usr/src/app diff --git a/docker/services.dockerfile b/docker/services.dockerfile index 0f8689c0b5b..47cae43688f 100644 --- a/docker/services.dockerfile +++ b/docker/services.dockerfile @@ -1,6 +1,6 @@ FROM node:24.14.1-slim -RUN apt-get update && apt-get install -y wget ca-certificates && rm -rf /var/lib/apt/lists/* +RUN apt-get update && apt-get upgrade -y && apt-get install -y wget ca-certificates && rm -rf /var/lib/apt/lists/* ARG SERVICE_DIR_NAME WORKDIR /usr/src/app/$SERVICE_DIR_NAME From 3c8f188bc3ff7568f6d6fce8757927ccc5b9f40f Mon Sep 17 00:00:00 2001 From: Rick Bijkerk Date: Tue, 2 Jun 2026 12:11:01 +0200 Subject: [PATCH 2/2] chore: use --no-install-recommends for apt upgrade/install --- docker/cli.dockerfile | 2 +- docker/migrations.dockerfile | 2 +- docker/services.dockerfile | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/docker/cli.dockerfile b/docker/cli.dockerfile index bfd0bc51441..c26e1dcd329 100644 --- a/docker/cli.dockerfile +++ b/docker/cli.dockerfile @@ -1,6 +1,6 @@ FROM node:24.14.1-slim -RUN apt-get update && apt-get upgrade -y && apt-get install -y --no-install-recommends ca-certificates git && rm -rf /var/lib/apt/lists/* +RUN apt-get update && apt-get upgrade -y --no-install-recommends && apt-get install -y --no-install-recommends ca-certificates git && rm -rf /var/lib/apt/lists/* ARG CLI_VERSION diff --git a/docker/migrations.dockerfile b/docker/migrations.dockerfile index 72d12407f33..15dd2611d4a 100644 --- a/docker/migrations.dockerfile +++ b/docker/migrations.dockerfile @@ -1,6 +1,6 @@ FROM node:24.14.1-slim -RUN apt-get update && apt-get upgrade -y && apt-get install -y ca-certificates && rm -rf /var/lib/apt/lists/* +RUN apt-get update && apt-get upgrade -y --no-install-recommends && apt-get install -y --no-install-recommends ca-certificates && rm -rf /var/lib/apt/lists/* WORKDIR /usr/src/app diff --git a/docker/services.dockerfile b/docker/services.dockerfile index 47cae43688f..fb90b2159f4 100644 --- a/docker/services.dockerfile +++ b/docker/services.dockerfile @@ -1,6 +1,6 @@ FROM node:24.14.1-slim -RUN apt-get update && apt-get upgrade -y && apt-get install -y wget ca-certificates && rm -rf /var/lib/apt/lists/* +RUN apt-get update && apt-get upgrade -y --no-install-recommends && apt-get install -y --no-install-recommends wget ca-certificates && rm -rf /var/lib/apt/lists/* ARG SERVICE_DIR_NAME WORKDIR /usr/src/app/$SERVICE_DIR_NAME