From e054dbb8a4231d55db8c270011e4b1ebf7832c34 Mon Sep 17 00:00:00 2001 From: Lakshman Patel Date: Mon, 7 Sep 2026 18:25:48 +0530 Subject: [PATCH] fix(sandbox): pin Debian security suite to avoid stale libssh2 --- internal/sandbox/sandbox.Dockerfile | 20 +++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-) diff --git a/internal/sandbox/sandbox.Dockerfile b/internal/sandbox/sandbox.Dockerfile index 7aa86c24..7aa6d2dc 100644 --- a/internal/sandbox/sandbox.Dockerfile +++ b/internal/sandbox/sandbox.Dockerfile @@ -1,6 +1,24 @@ FROM node:22-bookworm-slim@sha256:4d676821dff059fd00d277ee4261ef34ea712317fed0737c03941481b5760c96 -RUN npm install --global npm@12.0.2 && \ +# Configure package sources explicitly rather than relying on the base image's +# snapshot-pinned debian.sources, which can lag the security suite (libssh2-1 +# shipped 1.10.0-3+b1 until DSA-6365-1 published 1.10.0-3+deb12u1). Pinning +# bookworm-security here keeps every build on current security fixes and never +# serves a stale cached apt layer. +RUN printf '%s\n' \ + 'Types: deb' \ + 'URIs: http://deb.debian.org/debian' \ + 'Suites: bookworm bookworm-updates' \ + 'Components: main' \ + 'Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg' \ + '' \ + 'Types: deb' \ + 'URIs: http://deb.debian.org/debian-security' \ + 'Suites: bookworm-security' \ + 'Components: main' \ + 'Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg' \ + > /etc/apt/sources.list.d/debian.sources && \ + npm install --global npm@12.0.2 && \ npm cache clean --force && \ rm -rf /root/.npm && \ apt-get update && \