chore: pin alpine docker image to 3.23.5 (backport to release/1.8.x) - #1192
Merged
Conversation
## Related issues n/a — routine base image refresh, required by the CLI release runbook (Step 5) ahead of the v1.8.3 monthly release. ## What changed? Bumps the Dockerfile base image from `alpine:3.23.4` to `alpine:3.23.5`. Exact package delta in the built image, verified by building this Dockerfile on both bases and diffing `apk info -v` (the rest of the 18-package set is identical): | package | 3.23.4 | 3.23.5 | |---|---|---| | `alpine-release` | 3.23.4-r0 | 3.23.5-r0 | | `ca-certificates-bundle` | 20260413-r0 | 20260611-r0 | | `libcrypto3` | 3.5.6-r0 | 3.5.7-r0 | | `libssl3` | 3.5.6-r0 | 3.5.7-r0 | `openssl 3.5.7-r0` carries fixes for 15 CVEs per the Alpine security database: CVE-2026-34180, -34181, -34182, -34183, -42764, -42766, -42767, -42768, -42769, -42770, -45445, -45446, -45447, -7383, -9076. Two notes on impact: - The CLI binary is built with `CGO_ENABLED=0`, so it does not link `libssl`/`libcrypto` — those are present only because busybox's `ssl_client` pulls them in. The CVEs are very likely not reachable from the CLI, but image scanners flag by installed package version, so they show up against a `latest`-tagged public image regardless. - The `ca-certificates-bundle` refresh **is** functionally live: Go's `crypto/x509` reads the system trust store from `/etc/ssl/certs` at runtime. ### Why 3.23.5 and not 3.24.1 `3.24.1` has **identical** `libcrypto3` (3.5.7-r0), `libssl3` (3.5.7-r0) and `ca-certificates-bundle` (20260611-r0), so it offers no security benefit today. It additionally bumps `musl` 1.2.5-r23 → 1.2.6-r2, `busybox` r30 → r31, `alpine-baselayout` r0 → r1 and `scanelf`. Worth noting `3.23.5` (pushed 2026-06-22) is actually a *newer build* than `3.24.1` (2026-06-16), and there is no `3.24.2`. Moving to the 3.24 line is worth doing for the longer support runway — better as its own change on `main` with time to bake, rather than folded into a patch release. ## Checklist **Stability** - [x] Breaking changes are marked with 💥 in the PR title and release notes — n/a - [x] Changes to JSON output (`-o json` / `-o jsonl`) are treated as breaking changes — n/a ## Manual tests Built the repo's Dockerfile on each base and compared the full package set: ``` $ docker build --platform linux/amd64 -t alpinetest:3.23.4 -f Dockerfile.3.23.4 . $ docker build --platform linux/amd64 -t alpinetest:3.23.5 -f Dockerfile.3.23.5 . $ diff <(docker run --rm alpinetest:3.23.4 apk info -v | sort) \ <(docker run --rm alpinetest:3.23.5 apk info -v | sort) < alpine-release-3.23.4-r0 > alpine-release-3.23.5-r0 < ca-certificates-bundle-20260413-r0 > ca-certificates-bundle-20260611-r0 < libcrypto3-3.5.6-r0 < libssl3-3.5.6-r0 > libcrypto3-3.5.7-r0 > libssl3-3.5.7-r0 ``` Both images build clean and `adduser`/`apk add` behave identically. ## Follow-up Once merged, this needs cherry-picking to `release/1.8.x` for the v1.8.3 release. (cherry picked from commit a46e993)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Related issues
Backport of #1188 to
release/1.8.x, required by Step 5 of the CLI releaserunbook
before v1.8.3 is cut.
What changed?
Clean cherry-pick of
a46e993d— bumps the Dockerfile base image fromalpine:3.23.4toalpine:3.23.5. One line, no conflicts.Exact package delta in the built image:
alpine-releaseca-certificates-bundlelibcrypto3libssl3openssl 3.5.7-r0carries fixes for 15 CVEs per the Alpine security database:CVE-2026-34180, -34181, -34182, -34183, -42764, -42766, -42767, -42768, -42769,
-42770, -45445, -45446, -45447, -7383, -9076.
See #1188 for the full rationale, including why 3.23.5 rather than 3.24.1.
Why a PR rather than pushing to the release branch
release/1.8.xis unprotected, but CI does not run on pushes to it — thechecks on #1185 ran against the PR, not the branch. Going through a PR is the
only way to get this validated before v1.8.3 is cut.
Manual tests
Built the release-branch Dockerfile on the new base and confirmed the expected
package versions land:
Diff against
release/1.8.xis the singleFROMline.