mirror of
https://github.com/windmill-labs/windmill.git
synced 2026-08-18 08:01:26 +00:00
Ruben Fiszel
5626768471
The published ghcr.io/windmill-labs/windmill-cli image shipped two fixable CRITICAL findings: - openssl (libssl3t64, openssl-provider-legacy): stale in the oven/bun:slim base image (CVE-2026-34182). Fixed by running apt-get upgrade so the image picks up the patched Debian packages. - vitest 2.1.9 (CVE-2026-47429 / GHSA-5xrq-8626-4rwp): a dev-only devDependency reference in esrap's cached package.json living in bun's package download cache. The cache is unused at runtime, so it is removed after install. Validated by building the image and scanning with Trivy: openssl now reports 3.5.6-1~deb13u2 (fixed) and vitest is entirely absent. wmill still runs. The only remaining CRITICALs are perl-base CVEs with no upstream fix available. Fixes GIT-922 Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
16 lines
533 B
Plaintext
16 lines
533 B
Plaintext
FROM oven/bun:slim
|
|
|
|
# Pick up upstream OS security fixes present in the base image (e.g. openssl CVE-2026-34182).
|
|
RUN apt-get update \
|
|
&& apt-get -y upgrade \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Install the CLI, then drop bun's package download cache: its cached manifests
|
|
# (e.g. esrap's dev-only vitest devDependency) trip vulnerability scanners and are
|
|
# unused at runtime.
|
|
RUN bun install -g windmill-cli \
|
|
&& ln -s $(bun pm bin -g)/wmill /usr/bin/wmill \
|
|
&& rm -rf /root/.bun/install/cache
|
|
|
|
ENTRYPOINT [ "wmill" ]
|