From 2339b89335cc098322e0e986f16aa60480711c0a Mon Sep 17 00:00:00 2001
From: Connor Murphy <connor@plural.sh>
Date: Fri, 25 Sep 2026 14:25:48 +0000
Subject: [PATCH] fix(security): pin Console libexpat remediation

---
 Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Dockerfile b/Dockerfile
index 0552259ece..d0a538a9b2 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -121,7 +121,7 @@ COPY --from=tools /usr/local/bin/plural /usr/local/bin/plural
 
 WORKDIR /opt/app
 
-RUN [ "$OS_VARIANT" = "alpine" ] && apk update && apk upgrade --no-cache libexpat zlib musl musl-utils || true
+RUN [ "$OS_VARIANT" = "alpine" ] && apk update && apk add --no-cache libexpat=2.8.5-r0 && apk upgrade --no-cache zlib musl musl-utils || true
 
 COPY bin/setup/${OS_VARIANT}.sh /opt/app/bin/setup.sh
 RUN /bin/sh /opt/app/bin/setup.sh && rm /opt/app/bin/setup.sh