From 5e3b95a9f0e43385a77e42aa7ea55386e06079f7 Mon Sep 17 00:00:00 2001 From: Imani Manyara Date: Thu, 8 Oct 2026 07:47:12 -0400 Subject: [PATCH] Upgrade Debian perl packages in the pg and cassandra 4.1 images Debian published perl 5.36.0-7+deb12u4, fixing CVE-2026-13221, -8376, -42496 (CRITICAL) and -42497, -48962, -57432, -57433 (HIGH). The pinned bookworm bases still carry deb12u3, so Trivy's fixed-only HIGH/CRITICAL gate failed every pg major and cassandra 4.1 on both architectures. pgvector has not rebuilt 0.8.6 since 2026-08-13, so there is no newer base digest to repin to. Upgrade the named packages instead, the same pattern already used for pcre2 and expat: the four perl packages in pg move together because perl depends on the exact perl-base version, and cassandra 4.1 carries perl-base only. The scan gate is unchanged. --- images/cassandra/Dockerfile | 10 ++++++---- images/pg/Dockerfile | 12 ++++++++---- 2 files changed, 14 insertions(+), 8 deletions(-) diff --git a/images/cassandra/Dockerfile b/images/cassandra/Dockerfile index 62c8477..699131a 100644 --- a/images/cassandra/Dockerfile +++ b/images/cassandra/Dockerfile @@ -45,10 +45,12 @@ ENV DEBIAN_FRONTEND=noninteractive RUN set -eux; \ apt-get update; \ apt-get install -y --no-install-recommends ca-certificates curl procps xz-utils zstd; \ - # The base digest predates Debian's pcre2 and expat security updates. They - # are fixable, so they are fixed -- named packages only, so nothing else in - # the pinned base moves. - apt-get install -y --only-upgrade libpcre2-8-0 libexpat1; \ + # The base digest predates Debian's pcre2, expat and perl-base security + # updates. They are fixable, so they are fixed -- named packages only, so + # nothing else in the pinned base moves. perl-base is the only perl package + # the bookworm-based 4.1 image carries (fixed in 5.36.0-7+deb12u4); on a + # base where a named package is absent, --only-upgrade skips it. + apt-get install -y --only-upgrade libpcre2-8-0 libexpat1 perl-base; \ rm -rf /var/lib/apt/lists/* # gosu from the gotools stage (DESIGN.md D-51). gosu replaces diff --git a/images/pg/Dockerfile b/images/pg/Dockerfile index ad027f7..e2e8f5f 100644 --- a/images/pg/Dockerfile +++ b/images/pg/Dockerfile @@ -154,10 +154,14 @@ ENV DEBIAN_FRONTEND=noninteractive \ # during step 1 research (DESIGN.md section 4). RUN set -eux; \ apt-get update; \ - # The base digest predates Debian's pcre2 and expat security updates. They - # are fixable, so they are fixed -- named packages only, so the PostgreSQL - # server the digest pins does not move. - apt-get install -y --only-upgrade libpcre2-8-0 libexpat1; \ + # The base digest predates Debian's pcre2, expat and perl security updates. + # They are fixable, so they are fixed -- named packages only, so the + # PostgreSQL server the digest pins does not move. The four perl packages + # move together: perl depends on the exact perl-base version, so upgrading + # one alone does not resolve. pgvector has not rebuilt 0.8.6 since + # 2026-08-13, so there is no newer digest to repin to (perl 5.36.0-7+deb12u4). + apt-get install -y --only-upgrade libpcre2-8-0 libexpat1 \ + perl perl-base perl-modules-5.36 libperl5.36; \ apt-get install -y --no-install-recommends \ ca-certificates \ curl \