mirror of
https://github.com/windmill-labs/windmill.git
synced 2026-08-18 16:02:10 +00:00
Aldrin Jenson
d23d8374dd
* Harden slim image security surface * Limit slim hardening to libgnutls pin * fix(docker): pin libgnutls30 to exact +deb12u7 in slim images Replace the +deb12u* wildcard with the exact current security build so builds fail loudly when Debian ships a newer patch, prompting an explicit review/bump rather than silently floating forward. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(docker): drop libgnutls30 version pin, keep explicit listing The version pin (exact or wildcard) was not the load-bearing part of this change. Naming libgnutls30 explicitly in apt-get install is what forces apt to upgrade it past the base image's older pre-installed version — transitive deps from wget/curl/git would otherwise leave it in place because their version constraints are already satisfied. Dropping the version specifier so each rebuild picks up the current security build automatically, matching the PR's stated intent. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * chore(docker): drop libgnutls30 comment Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Ruben Fiszel <ruben@windmill.dev> Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>