From 114e8159ee391ed6397ab2f18e954cb2219c8a14 Mon Sep 17 00:00:00 2001
From: Blake Bertuccelli-Booth <46652+bbertucc@users.noreply.github.com>
Date: Sun, 4 Oct 2026 09:41:07 -0400
Subject: [PATCH] fix(image): take Debian security fixes at build time (#504)

The scan check fails on libpcre2-8-0 (CVE-2026-103111, HIGH): node:24-slim
ships 10.42-1+deb12u1 and the fix is in deb12u2. `apt-get upgrade` picks up
fixes like this before the base image is rebuilt.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 Dockerfile | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index c542f797..2a796f47 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -5,8 +5,10 @@ FROM node:24-slim
 # git: agents/ is a git checkout (SHA pinning) and the contribution
 # workflow inspects it. poppler-utils: pdftoppm/pdfinfo for rasterizing uploaded
 # PDFs into per-page images, and pdftohtml for reading their link annotations,
-# which rasterizing destroys (src/pipeline/links.ts).
-RUN apt-get update && apt-get install -y --no-install-recommends git ca-certificates poppler-utils \
+# which rasterizing destroys (src/pipeline/links.ts). `upgrade` takes Debian's security fixes
+# before the node image is rebuilt with them, which the `scan` check needs (docs/ci.md).
+RUN apt-get update && apt-get upgrade -y \
+    && apt-get install -y --no-install-recommends git ca-certificates poppler-utils \
     && rm -rf /var/lib/apt/lists/*
 
 WORKDIR /app