Image 18.6 contains fixable CRITICAL/HIGH CVEs, could you rebuild?

[delta-whiplash]

First of all, thanks a lot for the CloudNativePG PostgreSQL images, it's been working great for us in production. Really appreciate the work you put into it! 🙏

I noticed the ghcr.io/cloudnative-pg/postgresql:18.6 image fails our Trivy scan with fixable CRITICAL/HIGH CVEs:

ghcr.io/cloudnative-pg/postgresql:18.6@sha256:d7a81cb5da3182d95d0da5fabfb9e484e375db899dcd54b684105f1e8966e9ca

Could you have a look and rebuild with patched base packages when you get a chance, please?
Thanks again for the project! 🚀

[dosubot]

Hi @delta-whiplash! I'm Dosu and I'm helping the CloudNativePG team.

A couple of things that might be useful context while you wait for a maintainer:

The base image digests were recently refreshed. Renovate Bot updated the pinned Debian base image digests on August 5 (PR #489), and 18.6 is in the current build matrix [1]. However, whether a new build actually ran and published after that digest update determines whether the image you're scanning reflects the patched base packages. The weekly bake runs Mondays at 08:00 UTC [2], and it has been flaky at times due to QEMU/arm64 segfaults and Debian repo network errors [3] — so there can be a lag between Renovate merging a new digest and images actually getting rebuilt [4].

A related Dockerfile issue exists. Issue #494 was filed pointing out that the Dockerfile runs apt-get update + apt-get install but not apt-get upgrade [5]. This means packages already in the base layer that have available security updates won't get upgraded during the build. This is a likely contributing factor to fixable CVEs persisting even after a base digest bump.

So the fix likely involves two things: (1) a maintainer triggering a manual rebuild now that the August 5 digest update is merged, and/or (2) addressing the missing apt-get upgrade in the Dockerfile (issue #494), which would make every future build automatically pick up all available security fixes from Debian.

To reply, just mention @dosu.

---

Share context across your team and agents. Try Dosu.