[peppescg]

Summary

Rebuilds the guest base image with the Brotli decoder fix for CVE-2026-111497. Google Brotli's decoder 1.0.3–1.2.0 can write out of bounds on a crafted br stream. In the guest, node (including built-in fetch) and curl --compressed decode br responses from whatever URL an agent fetches.

Both /usr/bin/node and libcurl.so.4 link the shared libbrotlidec.so.1. I checked their ELF DT_NEEDED entries; Node does not use a bundled copy. Upgrading libbrotlidec1 therefore fixes both.

The published base:latest (sha256:dcc40097…, built 2026-10-21 12:08 UTC) predates Wolfi's patch (wolfi-dev/os, merged 17:56 the same day) and the brotli/1.2.1 package (2026-10-22). The weekly Monday rebuild could reuse the cached apk add layer through the GHA cache. This change:

• requires libbrotlidec1>=1.2.1, so a stale index fails the build instead of shipping the vulnerable decoder;
• changes the apk add layer, so the build misses the cache;
• touches images/**, so merging it rebuilds base and every image built from it (claude-code, codex, opencode, hermes, gemini).

Before | After

	Before (base:latest today)	After (this branch)
libbrotlidec1	1.2.0-r6 (vulnerable)	1.2.1-r1
nodejs-26	26.12.0-r0	26.12.1-r2
curl	8.22.0-r4	8.23.0-r2

Downstream

Mecatl pins this image in its execution workload, in mecatui, and in microVM releases (base:latest resolved at release time). stacklok/mecatl#2507 fixes Mecatl's other images and will need a follow-up digest bump once this image is published.

Verification

• task image-base builds successfully (linux/arm64 locally).
• In the built image: libbrotlidec1-1.2.1-r1, nodejs-26-26.12.1-r2, curl-8.23.0-r2. curl --version reports brotli/1.2.1, and a Node zlib Brotli compress/decompress round trip succeeds. task, golangci-lint, and goimports are still installed in /usr/local/bin.
• On linux/amd64 and linux/arm64, apk add nodejs curl 'libbrotlidec1>=1.2.1' on wolfi-base:latest resolves libbrotlidec1-1.2.1-r1 and Node v26.12.1, and the Brotli round trip passes.
• Base image before the change: package lists read with crane export from ghcr.io/stacklok/brood-box/base:latest (sha256:dcc40097…).

🤖 Generated with Claude Code