From 14acd77626ae8dcef03eaf5dbc717b8fcfe6d622 Mon Sep 17 00:00:00 2001 From: Charles Bochet Date: Fri, 15 May 2026 11:27:23 +0200 Subject: [PATCH] fix(docker): pin node:24-alpine to 24.15.0-alpine3.23 digest (#20603) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Summary - ECR Inspector flagged 9 CVEs on the `prod-twenty` image — 8 PostgreSQL CVEs on `postgresql18-18.3-r0` (pulled in transitively by `apk add postgresql-client`) and CVE-2026-27135 on `nghttp2-1.68.0-r0` (pulled in by `curl` / `aws-cli`). - Alpine 3.23 already ships patched `postgresql18-18.4-r0` and `nghttp2-1.69.0-r0`, but the GHA buildx cache was reusing the stale `apk add` layer because `FROM node:24-alpine` had not moved. - Pinning the base image to `node:24.15.0-alpine3.23@sha256:8e2c930f…` forces a layer cache miss, picks up the patched apk packages, and gives Dependabot/Renovate a stable target for future digest bumps. Applied to both [packages/twenty-docker/twenty/Dockerfile](https://github.com/twentyhq/twenty/blob/charles/trusting-solomon-259ec8/packages/twenty-docker/twenty/Dockerfile) (4 stages → ECR `prod-twenty`) and [packages/twenty-docker/twenty-website-new/Dockerfile](https://github.com/twentyhq/twenty/blob/charles/trusting-solomon-259ec8/packages/twenty-docker/twenty-website-new/Dockerfile) (2 stages). ## Test plan - [ ] CI builds both images successfully on amd64 + arm64 - [ ] After merge + deploy, re-run ECR Inspector on the new `prod-twenty` image and confirm the 9 CVEs (CVE-2026-6473/6474/6475/6476/6477/6478/6479/6637 + CVE-2026-27135) are gone - [ ] Smoke-test the staging deployment (server boot, DB migrations via `psql` in the entrypoint) --- packages/twenty-docker/twenty-website-new/Dockerfile | 4 ++-- packages/twenty-docker/twenty/Dockerfile | 10 +++++----- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/packages/twenty-docker/twenty-website-new/Dockerfile b/packages/twenty-docker/twenty-website-new/Dockerfile index 0c24754830..1818eb160a 100644 --- a/packages/twenty-docker/twenty-website-new/Dockerfile +++ b/packages/twenty-docker/twenty-website-new/Dockerfile @@ -1,4 +1,4 @@ -FROM node:24-alpine AS twenty-website-new-build +FROM node:24.15.0-alpine3.23@sha256:d1b3b4da11eefd5941e7f0b9cf17783fc99d9c6fc34884a665f40a06dbdfc94f AS twenty-website-new-build WORKDIR /app @@ -20,7 +20,7 @@ COPY ./packages/twenty-shared /app/packages/twenty-shared COPY ./packages/twenty-website-new /app/packages/twenty-website-new RUN npx nx build twenty-website-new -FROM node:24-alpine AS twenty-website-new +FROM node:24.15.0-alpine3.23@sha256:d1b3b4da11eefd5941e7f0b9cf17783fc99d9c6fc34884a665f40a06dbdfc94f AS twenty-website-new WORKDIR /app/packages/twenty-website-new diff --git a/packages/twenty-docker/twenty/Dockerfile b/packages/twenty-docker/twenty/Dockerfile index feca20f209..e4fdf3260c 100644 --- a/packages/twenty-docker/twenty/Dockerfile +++ b/packages/twenty-docker/twenty/Dockerfile @@ -2,7 +2,7 @@ # Dependency stages # =========================================================================== -FROM node:24-alpine AS front-deps +FROM node:24.15.0-alpine3.23@sha256:d1b3b4da11eefd5941e7f0b9cf17783fc99d9c6fc34884a665f40a06dbdfc94f AS front-deps WORKDIR /app @@ -20,7 +20,7 @@ COPY ./packages/twenty-client-sdk/package.json /app/packages/twenty-client-sdk/ RUN yarn workspaces focus twenty twenty-front twenty-front-component-renderer twenty-ui twenty-shared twenty-sdk twenty-client-sdk && yarn cache clean && npx nx reset -FROM node:24-alpine AS server-deps +FROM node:24.15.0-alpine3.23@sha256:d1b3b4da11eefd5941e7f0b9cf17783fc99d9c6fc34884a665f40a06dbdfc94f AS server-deps WORKDIR /app @@ -84,7 +84,7 @@ RUN if [ -d /app/packages/twenty-front/build ]; then \ # docker build --target twenty-server -f packages/twenty-docker/twenty/Dockerfile . # =========================================================================== -FROM node:24-alpine AS twenty-server +FROM node:24.15.0-alpine3.23@sha256:d1b3b4da11eefd5941e7f0b9cf17783fc99d9c6fc34884a665f40a06dbdfc94f AS twenty-server RUN apk add --no-cache curl jq postgresql-client @@ -187,7 +187,7 @@ RUN S6_ARCH=$(cat /tmp/s6arch) && \ echo "$NOARCH_SUM s6-overlay-noarch.tar.xz" | sha256sum -c - && \ echo "$ARCH_SUM s6-overlay-arch.tar.xz" | sha256sum -c - -FROM node:24-alpine AS twenty-app-dev +FROM node:24.15.0-alpine3.23@sha256:d1b3b4da11eefd5941e7f0b9cf17783fc99d9c6fc34884a665f40a06dbdfc94f AS twenty-app-dev # s6-overlay COPY --from=s6-fetch /tmp/s6-overlay-noarch.tar.xz /tmp/ @@ -197,7 +197,7 @@ RUN tar -C / -Jxpf /tmp/s6-overlay-noarch.tar.xz \ && rm /tmp/s6-overlay-*.tar.xz RUN apk add --no-cache \ - postgresql16 postgresql16-contrib \ + postgresql18 postgresql18-contrib \ redis \ curl jq su-exec