From cdd94fb8a6d381fe7fd841707b3317ecd2e6368e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Peter=20Sandstr=C3=B6m?= Date: Mon, 19 Oct 2026 12:38:00 +0200 Subject: [PATCH] fix(docker): use version floors for apk packages instead of exact pins Alpine replaced libexpat 2.8.5 with 2.9.0 in its index, so the exact pin made every image build fail with 'unable to select packages'. That broke the Trivy stage and the Docker build on all PRs. A >= floor keeps the security minimum and survives index updates. Verified with a local build. Co-Authored-By: Claude Sonnet 5.5 Claude-Session: https://claude.ai/code/session_01RSop9MyLof8XxLTkFnF4KG --- Dockerfile | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) diff --git a/Dockerfile b/Dockerfile index f36a14a3..1c2cab1e 100644 --- a/Dockerfile +++ b/Dockerfile @@ -49,13 +49,18 @@ WORKDIR /app # Plugin installation needs npm; its mandatory triage gate needs Python and the # bundled triage skill copied below. Keep npm on the triaged, Node 22-compatible # release instead of inheriting whichever version ships in the base image. +# +# The apk packages use a FLOOR (>=), not an exact pin: Alpine replaces a package in its +# index when a fix lands (libexpat 2.8.5 became 2.9.0), and an exact pin then fails the +# whole image build with "unable to select packages". The floor keeps the security +# minimum and still builds when the index moves on. RUN apk add --no-cache --upgrade \ - bash=5.3.9-r1 \ - dumb-init=1.2.5-r4 \ - libcrypto3=3.5.9-r0 \ - libexpat=2.8.5-r0 \ - libssl3=3.5.9-r0 \ - python3=3.14.8-r0 \ + 'bash>=5.3.9-r1' \ + 'dumb-init>=1.2.5-r4' \ + 'libcrypto3>=3.5.9-r0' \ + 'libexpat>=2.8.5-r0' \ + 'libssl3>=3.5.9-r0' \ + 'python3>=3.14.8-r0' \ && npm install -g npm@11.19.1 --ignore-scripts \ && npm cache clean --force