From 802aebcb308fab20876770668b2c6a7efe494767 Mon Sep 17 00:00:00 2001 From: Keith Zeto Date: Wed, 30 Sep 2026 08:00:57 -0700 Subject: [PATCH] Bump APT_CACHE_BUST to clear 47 Trivy HIGH findings The PR scan on #146 flagged 52 fixable HIGH CVEs. 47 are OS packages: libssl3t64, openssl and openssl-provider-legacy at 3.5.7-1~deb13u2, and linux-libc-dev at 6.12.107-1. The cached apt layer is stale again. A fresh apt layer built today gets openssl 3.5.7-1~deb13u3 and linux-libc-dev 6.12.111-1, which are the fixed versions. The other 5 findings (engine.io and brace-expansion) come from the snyk-broker fork and are fixed in cortexapps/snyk-broker#30. Co-Authored-By: Claude Opus 5.5 --- docker/Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docker/Dockerfile b/docker/Dockerfile index bdf1531..1fd706a 100644 --- a/docker/Dockerfile +++ b/docker/Dockerfile @@ -32,7 +32,7 @@ WORKDIR /agent # when the scheduled Trivy scan flags OS-package CVEs whose fixes are already # in the archive — the cache is just serving a stale layer. Leaves the rest of # the build (Go, npm, snyk-broker clone) hitting cache as normal. -ARG APT_CACHE_BUST=2026-09-14 +ARG APT_CACHE_BUST=2026-09-30 # NOTE: build-essential is deliberately NOT installed here. It pulls in a full # C/C++ toolchain whose libc6-dev dependency drags in linux-libc-dev (the Linux # kernel headers), and that single package generates a steady stream of HIGH