Skip to content

fix(security): pin Console libexpat to 2.8.5-r0 #4418

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
plural-copilot wants to merge 1 commit into from
Closed

fix(security): pin Console libexpat to 2.8.5-r0 #4418

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@
ARG TOOLS_IMAGE=${OS_VARIANT}:${OS_VERSION}
ARG RUNNER_IMAGE=alpine:3.23.4 # TODO: change back to ${OS_VARIANT}:${OS_VERSION}

FROM node:24.11.1-alpine as node

Check warning on line 8 in Dockerfile

View workflow job for this annotation

GitHub Actions / Test Build Docker image

The 'as' keyword should match the case of the 'from' keyword 

FromAsCasing: 'as' and 'FROM' keywords' casing do not match
More info: https://docs.docker.com/go/dockerfile/rule/from-as-casing/

WORKDIR /app

Expand All @@ -27,12 +27,12 @@
COPY js/console/ ./console/
COPY js/design-system/ ./design-system/

ARG VITE_PROD_SECRET_KEY

Check warning on line 30 in Dockerfile

View workflow job for this annotation

GitHub Actions / Test Build Docker image

Sensitive data should not be used in the ARG or ENV commands 

SecretsUsedInArgOrEnv: Do not use ARG or ENV instructions for sensitive data (ARG "VITE_PROD_SECRET_KEY")
More info: https://docs.docker.com/go/dockerfile/rule/secrets-used-in-arg-or-env/
ARG VITE_SENTRY_DSN
ARG SENTRY_AUTH_TOKEN

Check warning on line 32 in Dockerfile

View workflow job for this annotation

GitHub Actions / Test Build Docker image

Sensitive data should not be used in the ARG or ENV commands 

SecretsUsedInArgOrEnv: Do not use ARG or ENV instructions for sensitive data (ARG "SENTRY_AUTH_TOKEN")
More info: https://docs.docker.com/go/dockerfile/rule/secrets-used-in-arg-or-env/
ARG GIT_COMMIT

ENV VITE_PROD_SECRET_KEY=${VITE_PROD_SECRET_KEY} \

Check warning on line 35 in Dockerfile

View workflow job for this annotation

GitHub Actions / Test Build Docker image

Sensitive data should not be used in the ARG or ENV commands 

SecretsUsedInArgOrEnv: Do not use ARG or ENV instructions for sensitive data (ENV "SENTRY_AUTH_TOKEN")
More info: https://docs.docker.com/go/dockerfile/rule/secrets-used-in-arg-or-env/

Check warning on line 35 in Dockerfile

View workflow job for this annotation

GitHub Actions / Test Build Docker image

Sensitive data should not be used in the ARG or ENV commands 

SecretsUsedInArgOrEnv: Do not use ARG or ENV instructions for sensitive data (ENV "VITE_PROD_SECRET_KEY")
More info: https://docs.docker.com/go/dockerfile/rule/secrets-used-in-arg-or-env/
VITE_GIT_COMMIT=${GIT_COMMIT} \
VITE_SENTRY_DSN=${VITE_SENTRY_DSN} \
SENTRY_AUTH_TOKEN=${SENTRY_AUTH_TOKEN}
Expand Down Expand Up @@ -91,7 +91,7 @@

RUN mix do db.certs, agent.chart, sentry.package_source_code, release

FROM alpine:3.21.3 as tools

Check warning on line 94 in Dockerfile

View workflow job for this annotation

GitHub Actions / Test Build Docker image

The 'as' keyword should match the case of the 'from' keyword 

FromAsCasing: 'as' and 'FROM' keywords' casing do not match
More info: https://docs.docker.com/go/dockerfile/rule/from-as-casing/

ARG TARGETARCH=amd64
ENV CLI_VERSION=v0.12.65
Expand Down Expand Up @@ -121,7 +121,7 @@

WORKDIR /opt/app

RUN [ "$OS_VARIANT" = "alpine" ] && apk update && apk upgrade --no-cache libexpat zlib musl musl-utils || true
RUN [ "$OS_VARIANT" = "alpine" ] && apk update && apk add --no-cache libexpat=2.8.5-r0 && apk upgrade --no-cache zlib musl musl-utils || true

@greptile-apps greptile-apps Bot Sep 25, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 security Package failures are hidden

If libexpat=2.8.5-r0 becomes unavailable in the Alpine repository, apk add fails and skips the zlib and musl upgrades. The trailing || true still lets the image build and publish, so the libexpat fix may not reach the runtime image. Make the Alpine install fail the build and verify the package version in the final image.

How this was verified: A failed apk add stops the && chain, while || true makes the RUN instruction succeed.


COPY bin/setup/${OS_VARIANT}.sh /opt/app/bin/setup.sh
RUN /bin/sh /opt/app/bin/setup.sh && rm /opt/app/bin/setup.sh
Expand Down Expand Up @@ -155,4 +155,4 @@

EXPOSE 4000 6000 4369 50051

CMD mkdir -p /tmp/sqlite; /opt/app/bin/console start

Check warning on line 158 in Dockerfile

View workflow job for this annotation

GitHub Actions / Test Build Docker image

JSON arguments recommended for ENTRYPOINT/CMD to prevent unintended behavior related to OS signals 

JSONArgsRecommended: JSON arguments recommended for CMD to prevent unintended behavior related to OS signals
More info: https://docs.docker.com/go/dockerfile/rule/json-args-recommended/
Loading