-
[OPIK-6616] fix(docker): upgrade nghttp2-libs in opik-frontend (CVE-2026-27135) (#6788)
frostbyte_neo 发布于
2026-05-20 15:47:20 +00:00 - [OPIK-6616] fix(docker): upgrade nghttp2-libs in opik-frontend (CVE-2026-27135)
Trivy scan of self-hosted v4.17.1 release flagged opik-frontend-comet:2.0.39
with HIGH CVE-2026-27135 in nghttp2-libs 1.68.0-r0 — nghttp2 DoS via
malformed HTTP/2 frames after session termination. Fixed in nghttp2 1.68.1.The vulnerable package ships with the nginx:1.29.8-alpine-otel base
image (Alpine 3.23.4). Rather than bumping nginx itself, this adds an
apk add --no-cache --upgrade nghttp2-libsstep in the runtime nginx
stage so the patched version is pulled from the Alpine package index
without changing nginx behavior.See OPIK-6616 for full per-image CVE report.
Co-Authored-By: Claude Opus 4.7 (1M context) noreply@anthropic.com
- [OPIK-6616] fix(docker): bump nginx base 1.29.8-alpine-otel -> 1.30.1-alpine-otel
In addition to the apk upgrade of nghttp2-libs, bump the nginx base
image itself. The 1.30.1-alpine-otel tag was rebuilt 2026-05-19 with a
fresh Alpine 3.23 layer that already includes the CVE-2026-27135 fix.
The apk upgrade line is kept as defense-in-depth so future builds
remain protected even if upstream tags lag.Co-Authored-By: Claude Opus 4.7 (1M context) noreply@anthropic.com
- [OPIK-6616] revert nginx 1.30.1-otel bump; keep apk upgrade nghttp2-libs
Reverts the FROM nginx:1.29.8-alpine-otel -> 1.30.1-alpine-otel bump
for consistency with comet-react#7729. The same minor bump on the
plain alpine variant broke the comet-mini integration test in
comet-react (frontend pod /api/isAlive/ping returned 000 after a full
5-minute timeout window).opik's CI doesn't run the equivalent deployment + healthcheck test for
opik-frontend, so the bump appeared "all green" here while actually
being untested. Safer to keep this PR aligned with comet-react and
stay on 1.29.8.The apk add --no-cache --upgrade nghttp2-libs line is kept — it still
closes CVE-2026-27135 by pulling 1.69.0-r0 from the Alpine 3.23
package index at build time, even though the 1.29.8-alpine-otel base
still ships 1.68.0-r0.Co-Authored-By: Claude Opus 4.7 (1M context) noreply@anthropic.com
- [OPIK-6616] re-bump nginx base to 1.30.1-alpine-otel (CI failure unrelated)
Re-applies the FROM nginx:1.30.1-alpine-otel bump that was reverted in
the previous commit. The revert was made for symmetry with comet-react
on the (mistaken) assumption that nginx 1.30 was breaking the
comet-mini integration test there. Validation in the comet-react repo
showed nginx 1.30 starts cleanly with the equivalent config locally,
and that the sameci / build-n-testjob ALSO fails on the reverted
1.29.8 state — confirming the failure is in the test cluster, not in
the Dockerfile change.Defense-in-depth restored: nginx base bump pulls a freshly built layer
with patched nghttp2-libs; the apk upgrade line guards against future
staleness of the 1.30.x tag.Co-Authored-By: Claude Opus 4.7 (1M context) noreply@anthropic.com
- fix(docker): drop apk upgrade nghttp2-libs to keep build reproducible
The base image nginx:1.30.1-alpine-otel already ships nghttp2-libs
1.69.0-r0, which is past the CVE-2026-27135 fix (>= 1.68.1). The
"apk add --no-cache --upgrade nghttp2-libs" step is therefore a no-op
on today's repo state, while introducing build non-reproducibility:
two builds of the same commit could resolve different package
versions as Alpine's repo evolves.Per andrescrz's review on PR #6788 — drop the apk step and rely on
the base image bump alone. When a future CVE requires it, we'll
bump the base tag again.Verified locally:
$ docker run --rm nginx:1.30.1-alpine-otel apk list -I | grep nghttp2
nghttp2-libs-1.69.0-r0 ...
$ apk upgrade --simulate nghttp2-libs
OK: 100.3 MiB in 157 packages (no upgrade available)Co-Authored-By: Claude Opus 4.7 (1M context) noreply@anthropic.com
Co-authored-by: Claude Opus 4.7 (1M context) noreply@anthropic.com
下载附件