HeiKyu/Rendezvous
2
0
Fork 0
Code Issues 14 Pull Requests Actions Packages Projects Releases 1 Wiki Activity

fix(security): pin runtime to .NET 10.0.11 chiseled (#1)
quality-gate / quality (push) Successful in 2m42s
Details
quality-gate / container (push) Successful in 1m55s
Details
immutable-release / release (push) Failing after 5m39s
Details

Browse Source 
The 10.0.9 ASP.NET chiseled base shipped Microsoft.NETCore.App 10.0.9,
which the release trivy gate flags with six HIGH advisories:
CVE-2026-47302, CVE-2026-50524, CVE-2026-50528, CVE-2026-50651 and
CVE-2026-57108 (fixed in 10.0.10) plus CVE-2026-62901 (fixed in
10.0.11). Move the runtime stage to 10.0.11-noble-chiseled, pinned by
multi-architecture manifest digest as before, so every finding clears in
one step.

The build stage keeps SDK 10.0.301: the published server is framework
dependent, so the shipped runtime comes from the aspnet base alone and
the discarded builder layer is never scanned.
This commit is contained in:
KyuubiYoru
2026-08-22 21:20:30 +02:00
parent 562b8308b7
commit b235670afd
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Dockerfile
+1 -1
View File
@@ -21,7 +21,7 @@ RUN dotnet publish src/FinalFactory.Rendezvous.Server/FinalFactory.Rendezvous.Se
/p:RepositoryCommit="$SOURCE_REVISION_ID" \ /p:RepositoryCommit="$SOURCE_REVISION_ID" \
/p:SourceRevisionId="$SOURCE_REVISION_ID" /p:SourceRevisionId="$SOURCE_REVISION_ID"
FROM mcr.microsoft.com/dotnet/aspnet:10.0.9-noble-chiseled@sha256:f820c4fbfb8bb204c3bbe05c69d48cd039cd0e67aa8f13ac1cec168819b90643 AS runtime FROM mcr.microsoft.com/dotnet/aspnet:10.0.11-noble-chiseled@sha256:0839314d08bb65da369135389a5d8291f75ace587fbb0488f469eb92c62eef68 AS runtime
ENV ASPNETCORE_HTTP_PORTS=8080 \ ENV ASPNETCORE_HTTP_PORTS=8080 \
DOTNET_EnableDiagnostics=0 \ DOTNET_EnableDiagnostics=0 \