From 586b592037875ac5d1571ca3018f70273fdc0b4a Mon Sep 17 00:00:00 2001 From: bgard68 Date: Tue, 25 Aug 2026 05:51:07 +0000 Subject: [PATCH] build(deps): refresh the pinned base image digests MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Same two systemd CVEs as on main: a local privilege escalation via systemd-homed, and an unprivileged local user being able to terminate arbitrary processes. Both are Debian packages inside the base image, not application code. This branch pinned the identical digests, so it carried the identical exposure — it simply had no alerts raised against it. The scan runs with ignore-unfixed, so anything it reports has a patch available; these were waiting on nothing but a digest refresh. sdk:10.0 e1fc6e42… -> e1ffd2a9… aspnet:10.0 207cc514… -> a4556ed0… Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_019h7znwAftvs36vD4YwKMRf --- Dockerfile.api | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Dockerfile.api b/Dockerfile.api index 5a954a9..ddf7750 100644 --- a/Dockerfile.api +++ b/Dockerfile.api @@ -6,7 +6,7 @@ # Dockerfile can produce a different image tomorrow, so a reproducible build and an audited # base are impossible with tags alone. Refresh with: # docker buildx imagetools inspect mcr.microsoft.com/dotnet/sdk:10.0 --format '{{.Manifest.Digest}}' -FROM mcr.microsoft.com/dotnet/sdk:10.0@sha256:e1fc6e423f543119c406d24e2e687d67c569f18f04a37a8b0005d80ad0dcee80 AS build +FROM mcr.microsoft.com/dotnet/sdk:10.0@sha256:e1ffd2a92ae84c1291bc1b6887501f8af98e6331e7af6d4c8d37168c5e87a64c AS build WORKDIR /src # Restore first (leverages layer caching) by copying only the project files and lock files. @@ -28,7 +28,7 @@ COPY src/ src/ RUN dotnet publish src/TodoApp.WebApi/TodoApp.WebApi.csproj \ -c Release -o /app/publish --no-restore /p:UseAppHost=false -FROM mcr.microsoft.com/dotnet/aspnet:10.0@sha256:207cc51496778557731c81ff670333d8ade4a4fec22768fd1be8e78474a84ecf AS final +FROM mcr.microsoft.com/dotnet/aspnet:10.0@sha256:a4556ed033fa96f984bb7a8d348851cb2d36b1281dd2420070045f664fbb5f94 AS final WORKDIR /app COPY --from=build /app/publish .