fix(security): pin Console libexpat to 2.8.5-r0

[plural-copilot]

Plural Service: mgmt/console

Summary

• Console image ghcr.io/pluralsh/console:sha-debb0b5: pin the Alpine runtime installation of libexpat from the vulnerable 2.8.4-r0 to the fixed exact version 2.8.5-r0. The final runtime stage now uses apk add --no-cache libexpat=2.8.5-r0 before its existing zlib/musl upgrades.

Coverage decision

• GitHub PR fix(security): remediate Console support image vulnerabilities #4412 is open (head 191bef4cefaf0a89a26375a49a783bc94a195478) and fully, precisely covers the Kubernetes Agent and Nexus source/build fixes, so they are intentionally not duplicated here:
  • Kubernetes Agent image ghcr.io/pluralsh/kubernetes-agent:0.12.47: Debian tzdata 2026b-0+deb12u1 → 2026c-0+deb12u1, plus OpenTelemetry v1.43/v1.44 → v1.45.0.
  • Nexus image ghcr.io/pluralsh/nexus:0.12.47: Debian tzdata 2026b-0+deb12u1 → 2026c-0+deb12u1.
• The Kubernetes Agent OpenTelemetry update is also already on master through merged PR fix(deps): remediate PROD-5214 dependency alerts #4375 (commit 7ed391c25a33cd40a361ce88ebff0325c031c763).

Validation

• git diff --check — passed.
• docker run --rm -e OS_VARIANT=alpine alpine:3.23.4 sh -ec '[ "$OS_VARIANT" = "alpine" ] && apk update && apk add --no-cache libexpat=2.8.5-r0 && apk upgrade --no-cache zlib musl musl-utils || true; apk info -e "libexpat=2.8.5-r0"' — passed; exact package installed and asserted.
• docker build --target tools -t console-libexpat-tools-check . — passed; produced sha256:27d0c99b035861c38257c94bb7cff4b72a567b4b6fe63017c91520ebaee5102e.

Explicit exclusions

• Did not attempt GO-2026-5932 (no fixed version).
• Did not modify Redis or cloud-query-db.
• Did not change image tags, GitOps deployment configuration, or the bundled plural CLI Go dependency (owned by pluralsh/plural-cli).

[plural-copilot]

This PR was generated by the codex Plural Agent Runtime. Here's some useful information you might want to know to evaluate the ai's perfomance:

Name	Details
💬 Prompt	Create one remediation PR in this repository for fixed-version findings in the live mgmt/console service inventory. Work directly on the source/build files only: do not change GitOps deployment configuration or image tags....
🔗 Run history	View run history

[soffi-ai]

Soffi AI Summary

This PR patches a security vulnerability in the Console Docker image by pinning the Alpine libexpat package to the fixed version 2.8.5-r0, replacing the previous unpinned upgrade of the vulnerable 2.8.4-r0 version. The change ensures the runtime container is not exposed to the libexpat CVE by explicitly installing the known-safe exact version before applying other package upgrades. Related fixes for the Kubernetes Agent and Nexus images (tzdata, OpenTelemetry) are intentionally excluded as they are covered by separate open/merged PRs.

Changes

Pin libexpat to patched version in Console image

• Changed the Dockerfile's Alpine runtime stage to explicitly install libexpat=2.8.5-r0 via apk add --no-cache before the existing zlib/musl upgrades, replacing the previous unpinned apk upgrade --no-cache libexpat that left the image exposed to the vulnerable 2.8.4-r0 package. (2339b89)

---

Updated: 2026-09-25 14:28 UTC

Deploy in Soffi

[greptile-apps]

Confidence Score: 3/5

[High risk] Pins a system library version in the container build.

The PR should not merge until a failed Alpine package install prevents publication of the runtime image.

Findings

1.   Package failures are hidden ▶

Summary

The PR pins libexpat to 2.8.5-r0 in the Console Alpine runtime image while retaining the existing zlib and musl upgrades.

• An unavailable pin can silently bypass both the intended fix and those upgrades.

_{Reviews (1) · Last reviewed commit: "fix(security): pin Console libexpat reme..."}

[greptile-apps]

Package failures are hidden

If libexpat=2.8.5-r0 becomes unavailable in the Alpine repository, apk add fails and skips the zlib and musl upgrades. The trailing || true still lets the image build and publish, so the libexpat fix may not reach the runtime image. Make the Alpine install fail the build and verify the package version in the final image.

How this was verified: A failed apk add stops the && chain, while || true makes the RUN instruction succeed.