From e3241eea3de723f8d9eb3f3ad59365b446b693b0 Mon Sep 17 00:00:00 2001
From: neon <18559658+neonsolstice@users.noreply.github.com>
Date: Sat, 5 Sep 2026 10:06:56 +0000
Subject: [PATCH] security(deps): patch container vulnerabilities

Use the supported Alpine 3.23 Node image to avoid vulnerable util-linux packages in Alpine 3.24. Force fast-uri 3.1.6 to resolve the SSRF advisories reported by the image scan.
---
 Dockerfile          |  2 +-
 pnpm-lock.yaml      | 11 +++--------
 pnpm-workspace.yaml |  2 +-
 3 files changed, 5 insertions(+), 10 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 26b737253..a82ca071c 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,4 @@
-ARG NODE_IMAGE=node:26.7.0-alpine@sha256:aadf416b2cdce311a8811ba3f0608a61b77dbf997500e2eafe781b51f6a0b019
+ARG NODE_IMAGE=node:26.8.1-alpine3.23@sha256:871eb674ad6e692c91330a8959f1ce2f80ba3f445cdc54e306869d2ea265e42d
 
 FROM ${NODE_IMAGE} AS base
 RUN npm install -g pnpm@11.22.0
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index bea507097..3228f7ac8 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -15,7 +15,7 @@ overrides:
   engine.io: ^6.6.7
   esbuild: ^0.28.2
   fastify: ^5.10.0
-  fast-uri: ^3.1.5
+  fast-uri: ^3.1.6
   fast-xml-builder: ^1.3.1
   find-my-way: ^9.8.0
   form-data: ^4.0.6
@@ -5977,9 +5977,6 @@ packages:
   fast-safe-stringify@2.1.1:
     resolution: {integrity: sha512-W+KJc2dmILlPplD/H4K9l9LcAHAfPtP6BY84uVLXQ6Evcz9Lcg33Y2z1IVblT6xdY54PXYVHEv+0Wpq8Io6zkA==}
 
-  fast-uri@3.1.5:
-    resolution: {integrity: sha512-gHwA1O9LDIcKunMKhObS/HimwtehO1nPUECKAu5TpKgaO19fcWEl4bliWe1jWxVFvIXztJjjQ4L8XQ1EU9f7Jw==}
-
   fast-uri@3.1.6:
     resolution: {integrity: sha512-7Ical1vFEMr0onbVzEDIreM22I4khW+fzyQPwvAFWBp1iwdshSZRsL4jjRvPG9JP1uiqMHRto+YU6R2/CzDz5Q==}
 
@@ -13496,14 +13493,14 @@ snapshots:
   ajv@8.18.0:
     dependencies:
       fast-deep-equal: 3.1.3
-      fast-uri: 3.1.5
+      fast-uri: 3.1.6
       json-schema-traverse: 1.0.0
       require-from-string: 2.0.2
 
   ajv@8.20.0:
     dependencies:
       fast-deep-equal: 3.1.3
-      fast-uri: 3.1.5
+      fast-uri: 3.1.6
       json-schema-traverse: 1.0.0
       require-from-string: 2.0.2
 
@@ -14806,8 +14803,6 @@ snapshots:
 
   fast-safe-stringify@2.1.1: {}
 
-  fast-uri@3.1.5: {}
-
   fast-uri@3.1.6: {}
 
   fast-xml-builder@1.3.1:
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index 0090a90da..a1073fe69 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -13,7 +13,7 @@ overrides:
   engine.io: ^6.6.7
   esbuild: ^0.28.2
   fastify: ^5.10.0
-  fast-uri: ^3.1.5
+  fast-uri: ^3.1.6
   fast-xml-builder: ^1.3.1
   find-my-way: ^9.8.0
   form-data: ^4.0.6