Skip to content

Commit 34f31fc

Browse files
aarthy-dkclaude
andcommitted
fix: upgrade libcurl and busybox from Alpine edge to fix Wiz scan CVEs
Upgrade libcurl 8.17.0-r1 → 8.19.0-r0 and busybox 1.37.0-r30 → 1.37.0-r31 from Alpine edge repository. libcurl cannot be removed as librdkafka depends on it; upgrading resolves all 13 OS package findings (1 HIGH, 11 MEDIUM, 1 LOW) from the customer's second Wiz security scan. Ref: OBS-2001 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
1 parent da6c054 commit 34f31fc

1 file changed

Lines changed: 3 additions & 1 deletion

File tree

deploy/docker/observability-be.dockerfile

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,9 @@ RUN python3 -O -m pip install --no-deps /tmp/dk --prefix=/dk
3333
FROM ${BASE_IMAGE_URL}python:3.13-alpine3.23 AS runtime-image
3434

3535
RUN apk update && apk upgrade && apk add --no-cache librdkafka=2.12.1-r0 \
36-
&& apk del curl libcurl \
36+
&& apk del curl \
37+
&& apk upgrade --no-cache libcurl busybox busybox-binsh ssl_client \
38+
--repository=https://dl-cdn.alpinelinux.org/alpine/edge/main \
3739
&& pip install --no-cache-dir --upgrade pip
3840

3941
# Grab the pre-built app from the build-image. This way we don't have

0 commit comments

Comments
 (0)