From 7bb6671abfdf58870eb5eaa675b55d75ec6f3e55 Mon Sep 17 00:00:00 2001 From: jizhen181-dot Date: Sun, 25 Oct 2026 12:14:51 +0800 Subject: [PATCH] fix(docker): upgrade brotli-libs for CVE-2026-111497 Pin the runtime image to nginx:1.31-alpine3.24 and require brotli-libs >= 1.2.1-r0 from the Alpine 3.24 repository; the build fails if the fixed package is unavailable. Bump version to 1.4.23 so the release publishes a new image tag and keeps 1.4.22 for rollback. Co-Authored-By: Claude Opus 5.5 (1M context) --- Dockerfile | 7 ++++++- package.json | 2 +- 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/Dockerfile b/Dockerfile index a72cb24..a3bc07c 100644 --- a/Dockerfile +++ b/Dockerfile @@ -32,7 +32,12 @@ COPY . . RUN yarn build # Stage 2: Serve the application with Nginx -FROM nginx:alpine +# Pin the Alpine branch so security fixes come from the same branch's repository. +FROM nginx:1.31-alpine3.24 + +# CVE-2026-111497: brotli-libs must be 1.2.1-r0 or a later fix from the Alpine 3.24 repository. +# apk fails, and so does the build, if the repository cannot satisfy the constraint. +RUN apk add --no-cache --upgrade 'brotli-libs>=1.2.1-r0' # Create the log directory used in nginx.conf RUN mkdir -p /app/logs diff --git a/package.json b/package.json index c9792b7..2a14df8 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "@x402-tron/docs", - "version": "1.4.22", + "version": "1.4.23", "description": "x402-tron documentation", "license": "MIT", "resolutions": {