From 9ea154b8a2f0ff3ba487e24f830f2a1b388b2f59 Mon Sep 17 00:00:00 2001 From: okxlin <61420215+okxlin@users.noreply.github.com> Date: Fri, 10 Jul 2026 20:09:48 +0800 Subject: [PATCH] chore(infinite-canvas): update to 0.6.0 (#4692) --- apps/infinite-canvas/{0.5.0 => 0.6.0}/.env.sample | 0 apps/infinite-canvas/{0.5.0 => 0.6.0}/data.yml | 0 apps/infinite-canvas/{0.5.0 => 0.6.0}/data/.gitkeep | 0 .../{0.5.0 => 0.6.0}/docker-compose.yml | 2 +- .../infinite-canvas/{0.5.0 => 0.6.0}/scripts/init.sh | 0 .../{0.5.0 => 0.6.0}/scripts/uninstall.sh | 0 .../{0.5.0 => 0.6.0}/scripts/upgrade.sh | 0 apps/infinite-canvas/README.md | 12 ++++++------ 8 files changed, 7 insertions(+), 7 deletions(-) rename apps/infinite-canvas/{0.5.0 => 0.6.0}/.env.sample (100%) rename apps/infinite-canvas/{0.5.0 => 0.6.0}/data.yml (100%) rename apps/infinite-canvas/{0.5.0 => 0.6.0}/data/.gitkeep (100%) rename apps/infinite-canvas/{0.5.0 => 0.6.0}/docker-compose.yml (90%) rename apps/infinite-canvas/{0.5.0 => 0.6.0}/scripts/init.sh (100%) rename apps/infinite-canvas/{0.5.0 => 0.6.0}/scripts/uninstall.sh (100%) rename apps/infinite-canvas/{0.5.0 => 0.6.0}/scripts/upgrade.sh (100%) diff --git a/apps/infinite-canvas/0.5.0/.env.sample b/apps/infinite-canvas/0.6.0/.env.sample similarity index 100% rename from apps/infinite-canvas/0.5.0/.env.sample rename to apps/infinite-canvas/0.6.0/.env.sample diff --git a/apps/infinite-canvas/0.5.0/data.yml b/apps/infinite-canvas/0.6.0/data.yml similarity index 100% rename from apps/infinite-canvas/0.5.0/data.yml rename to apps/infinite-canvas/0.6.0/data.yml diff --git a/apps/infinite-canvas/0.5.0/data/.gitkeep b/apps/infinite-canvas/0.6.0/data/.gitkeep similarity index 100% rename from apps/infinite-canvas/0.5.0/data/.gitkeep rename to apps/infinite-canvas/0.6.0/data/.gitkeep diff --git a/apps/infinite-canvas/0.5.0/docker-compose.yml b/apps/infinite-canvas/0.6.0/docker-compose.yml similarity index 90% rename from apps/infinite-canvas/0.5.0/docker-compose.yml rename to apps/infinite-canvas/0.6.0/docker-compose.yml index 5e2de216f..da470994b 100644 --- a/apps/infinite-canvas/0.5.0/docker-compose.yml +++ b/apps/infinite-canvas/0.6.0/docker-compose.yml @@ -1,6 +1,6 @@ services: infinite-canvas: - image: "ghcr.io/basketikun/infinite-canvas:v0.5.0" + image: "ghcr.io/basketikun/infinite-canvas:v0.6.0" container_name: ${CONTAINER_NAME} restart: always networks: diff --git a/apps/infinite-canvas/0.5.0/scripts/init.sh b/apps/infinite-canvas/0.6.0/scripts/init.sh similarity index 100% rename from apps/infinite-canvas/0.5.0/scripts/init.sh rename to apps/infinite-canvas/0.6.0/scripts/init.sh diff --git a/apps/infinite-canvas/0.5.0/scripts/uninstall.sh b/apps/infinite-canvas/0.6.0/scripts/uninstall.sh similarity index 100% rename from apps/infinite-canvas/0.5.0/scripts/uninstall.sh rename to apps/infinite-canvas/0.6.0/scripts/uninstall.sh diff --git a/apps/infinite-canvas/0.5.0/scripts/upgrade.sh b/apps/infinite-canvas/0.6.0/scripts/upgrade.sh similarity index 100% rename from apps/infinite-canvas/0.5.0/scripts/upgrade.sh rename to apps/infinite-canvas/0.6.0/scripts/upgrade.sh diff --git a/apps/infinite-canvas/README.md b/apps/infinite-canvas/README.md index 66f69b043..1665d5b60 100644 --- a/apps/infinite-canvas/README.md +++ b/apps/infinite-canvas/README.md @@ -28,11 +28,11 @@ http://服务器IP:端口?apiKey={key}&baseUrl={address} 当前主应用镜像只启动 Next.js。画布、素材、生成记录和 AI API Key 默认保存在浏览器本地；第三方提示词由 Next.js 路由拉取后缓存在运行实例内存里，不需要额外挂载数据目录。 ## 安全提示 -维护侧已对当前 `latest` / `0.4.0` 对应的上游镜像 `ghcr.io/basketikun/infinite-canvas:v0.4.0` 做过 Trivy 扫描，报告为 `Critical=3`、`High=17`、`Total=178`。其中 Critical 主要来自 Debian 基础层 `perl-base`、`zlib1g`，当前没有可直接应用的上游修复版本。 +维护侧最近一次对当前打包镜像的 Trivy 扫描发现 `Critical=2`、`High=35`。Critical 项来自 Alpine OpenSSL 包，漏洞描述主要涉及 32 位系统；本应用声明的架构为 amd64 和 arm64，但基础镜像仍应升级到包含修复的 OpenSSL 版本。 -在 `--ignore-unfixed` 视角下，Critical 会消失，但仍有 `High=9`，主要集中在 `next 16.2.3`、`picomatch 4.0.3`、`sigstore 3.1.0`，需要上游更新依赖并重新构建镜像后才能消除。 +本次扫描中的 Critical 和 High 项均已有修复版本，主要涉及 OpenSSL、c-ares、libexpat 等基础包，需要上游重新构建镜像后才能消除。 -因此当前版本更适合部署在可信内网或受控环境中，并应尽快跟进上游镜像更新。若对暴露面更敏感，建议在网关或反向代理层额外限制访问来源。 +当前应用不使用特权模式、host network 或 Docker Socket，但仍建议部署在可信内网或受控环境中，并通过网关或反向代理限制访问来源。 ## Introduction Infinite Canvas is an open-source infinite canvas for AI creation. It supports text-to-image, image-to-image, reference image editing, text chat, audio generation, and video generation workflows. @@ -45,11 +45,11 @@ Infinite Canvas is an open-source infinite canvas for AI creation. It supports t - Browser-local storage for canvases, assets, generation history, and AI API keys ## Security Note -The current upstream image used by `latest` and `0.4.0` was scanned with Trivy and the report contains `Critical=3`, `High=17`, and `Total=178` findings. The Critical items are mainly in the Debian base layer (`perl-base`, `zlib1g`) and currently have no upstream fixed package available. +The latest maintainer Trivy scan of the packaged image reports `Critical=2` and `High=35`. The Critical entries come from Alpine OpenSSL packages and primarily describe a 32-bit platform scenario. This app targets amd64 and arm64, but the base image should still be rebuilt with fixed OpenSSL packages. -With `--ignore-unfixed`, the Critical findings drop out, but `High=9` remains, mainly in `next 16.2.3`, `picomatch 4.0.3`, and `sigstore 3.1.0`. Those require an upstream dependency refresh and image rebuild. +All Critical and High findings in this scan have fixed versions available. They mainly affect OpenSSL, c-ares, libexpat, and other base packages that require an upstream image rebuild. -Deploy this app in a trusted network or otherwise controlled environment, and update promptly when the upstream image is refreshed. +The app does not request privileged mode, host networking, or the Docker socket. Even so, deploy it in a trusted or otherwise controlled environment and restrict access through a gateway or reverse proxy where appropriate. ## 参考资料 - 源码: