From 0c58db2417da9d1046e22c0c453f73b834ddd958 Mon Sep 17 00:00:00 2001 From: SnapOtter Date: Mon, 8 Jun 2026 17:06:07 +0800 Subject: [PATCH] fix(security): update Go 1.24 and Pillow 12.1.1 for Trivy CVEs - Bump Go from 1.23 to 1.24 to fix CVE-2025-68121 (CRITICAL: crypto/tls certificate validation) and CVE-2025-61726 (HIGH: net/url memory exhaustion) in the caire binary. - Bump Pillow from 11.1.0 to 12.1.1 to fix CVE-2026-25990 (HIGH: out-of-bounds write via crafted image). --- docker/Dockerfile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docker/Dockerfile b/docker/Dockerfile index 29f2ee7f..af94bc8f 100644 --- a/docker/Dockerfile +++ b/docker/Dockerfile @@ -47,7 +47,7 @@ RUN --mount=type=cache,id=turbo-cache,target=/app/.turbo \ # on Apple Silicon when cross-compiling for linux/amd64. # caire imports gioui.org/app which requires CGO on Linux, so we use a # proper C cross-compiler instead of CGO_ENABLED=0. -FROM --platform=$BUILDPLATFORM golang:1.23-bookworm@sha256:167053a2bb901972bf2c1611f8f52c44d5fe7e762e5cab213708d82c421614db AS caire-builder +FROM --platform=$BUILDPLATFORM golang:1.24-bookworm@sha256:1a6d4452c65dea36aac2e2d606b01b4a029ec90cc1ae53890540ce6173ea77ac AS caire-builder ARG TARGETOS=linux ARG TARGETARCH @@ -239,7 +239,7 @@ RUN --mount=type=cache,target=/root/.cache/pip \ /opt/venv/bin/pip install --upgrade "pip==25.1.1" && \ /opt/venv/bin/pip install wheel setuptools && \ /opt/venv/bin/pip install \ - Pillow==11.1.0 \ + Pillow==12.1.1 \ numpy==1.26.4 \ opencv-python-headless==4.10.0.84