chore: pin curl to >=8.20.0-r0 to address CVE-2026-6429

Co-authored-by: linear-code[bot] <222613912+linear-code[bot]@users.noreply.github.com>

Author: linear-code[bot]

Dockerfile

@@ -166,7 +166,10 @@ ENV SOURCEBOT_LOG_LEVEL=info
 # ENV SOURCEBOT_TELEMETRY_DISABLED=1
 
 # Configure dependencies
-RUN apk add --no-cache git ca-certificates bind-tools tini jansson wget supervisor uuidgen curl perl jq openssl util-linux unzip && \
+# curl/libcurl pinned to >=8.20.0-r0 to address CVE-2026-6429 (credential leak
+# via reused proxy connection during HTTP redirects). The pin also busts the
+# build-cache layer so `apk upgrade` re-runs and pulls the patched packages.
+RUN apk add --no-cache git ca-certificates bind-tools tini jansson wget supervisor uuidgen "curl>=8.20.0-r0" perl jq openssl util-linux unzip && \
     apk upgrade --no-cache
 
 # Remove npm (unused — we use Yarn). The Node.js base image bundles npm