From b235670afda615cdab2f474efef905327ee08e4d Mon Sep 17 00:00:00 2001 From: KyuubiYoru Date: Sat, 22 Aug 2026 21:20:30 +0200 Subject: [PATCH] fix(security): pin runtime to .NET 10.0.11 chiseled (#1) The 10.0.9 ASP.NET chiseled base shipped Microsoft.NETCore.App 10.0.9, which the release trivy gate flags with six HIGH advisories: CVE-2026-47302, CVE-2026-50524, CVE-2026-50528, CVE-2026-50651 and CVE-2026-57108 (fixed in 10.0.10) plus CVE-2026-62901 (fixed in 10.0.11). Move the runtime stage to 10.0.11-noble-chiseled, pinned by multi-architecture manifest digest as before, so every finding clears in one step. The build stage keeps SDK 10.0.301: the published server is framework dependent, so the shipped runtime comes from the aspnet base alone and the discarded builder layer is never scanned. --- Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index b8a6071..2385042 100644 --- a/Dockerfile +++ b/Dockerfile @@ -21,7 +21,7 @@ RUN dotnet publish src/FinalFactory.Rendezvous.Server/FinalFactory.Rendezvous.Se /p:RepositoryCommit="$SOURCE_REVISION_ID" \ /p:SourceRevisionId="$SOURCE_REVISION_ID" -FROM mcr.microsoft.com/dotnet/aspnet:10.0.9-noble-chiseled@sha256:f820c4fbfb8bb204c3bbe05c69d48cd039cd0e67aa8f13ac1cec168819b90643 AS runtime +FROM mcr.microsoft.com/dotnet/aspnet:10.0.11-noble-chiseled@sha256:0839314d08bb65da369135389a5d8291f75ace587fbb0488f469eb92c62eef68 AS runtime ENV ASPNETCORE_HTTP_PORTS=8080 \ DOTNET_EnableDiagnostics=0 \