From 62c89a435d1f107fe3a5fe921fd2966db86436bd Mon Sep 17 00:00:00 2001 From: Giuseppe Scuglia Date: Sat, 24 Oct 2026 20:52:21 +0200 Subject: [PATCH] Require patched Brotli decoder in base image nodejs and curl in the base image link Wolfi's shared libbrotlidec. The published base:latest (built 2026-10-21 12:08 UTC) ships libbrotlidec1-1.2.0-r6, which predates Wolfi's CVE-2026-111497 patch (merged 17:56 the same day) and the 1.2.1 package. Require libbrotlidec1>=1.2.1 so the build fails on a stale index and the changed apk layer misses the GHA cache; merging under images/ also rebuilds base and every agent image derived from it. Co-Authored-By: Claude Opus 5.5 --- images/base/Dockerfile | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/images/base/Dockerfile b/images/base/Dockerfile index 27c31d4..98a4874 100644 --- a/images/base/Dockerfile +++ b/images/base/Dockerfile @@ -7,6 +7,9 @@ # agents..image in .broodbox.yaml. FROM cgr.dev/chainguard/wolfi-base:latest +# nodejs and curl link the shared Brotli decoder. Require the release that +# fixes CVE-2026-111497 so a stale package index fails the build instead of +# shipping the vulnerable decoder. RUN apk add --no-cache \ bash \ bash-binsh \ @@ -30,7 +33,8 @@ RUN apk add --no-cache \ py3-virtualenv \ nodejs \ npm \ - rust + rust \ + 'libbrotlidec1>=1.2.1' # Put Go and user-local binaries on PATH for all shells. # NOTE: Docker ENV PATH is NOT enough — Wolfi's /etc/profile rebuilds PATH