From b6bd4be3cf52becb5743850f087da87bd2d7516f Mon Sep 17 00:00:00 2001 From: Shaun Hirst Date: Tue, 7 Jul 2026 16:20:47 +0100 Subject: [PATCH 1/2] fix(docker): update base image to eclipse-temurin 17.0.19 on Ubuntu 26.04 Bump the published CLI and online image base from eclipse-temurin:17.0.9_9-jre-focal (Ubuntu 20.04) to eclipse-temurin:17.0.19_10-jre-resolute (Ubuntu 26.04). The focal-based image carried the critical/high CVEs reported by Snyk, which stem from outdated Ubuntu 20.04 system libraries (libcurl, freetype, krb5, glibc, sqlite, zlib, expat, libxml2, etc.). The resolute base ships patched versions of these and updates the JRE from 17.0.9 to 17.0.19. Stays glibc-based (same lineage as focal) and publishes linux/amd64 and linux/arm64, matching the release workflow's multi-arch build. Fixes #16791 --- modules/openapi-generator-cli/Dockerfile | 2 +- modules/openapi-generator-online/Dockerfile | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/modules/openapi-generator-cli/Dockerfile b/modules/openapi-generator-cli/Dockerfile index 4fa0deaaa54e..f3bc5199b576 100644 --- a/modules/openapi-generator-cli/Dockerfile +++ b/modules/openapi-generator-cli/Dockerfile @@ -1,4 +1,4 @@ -FROM eclipse-temurin:17.0.9_9-jre-focal +FROM eclipse-temurin:17.0.19_10-jre-resolute ADD target/openapi-generator-cli.jar /opt/openapi-generator/modules/openapi-generator-cli/target/openapi-generator-cli.jar diff --git a/modules/openapi-generator-online/Dockerfile b/modules/openapi-generator-online/Dockerfile index 806129c5ff57..51fdabdeb49a 100644 --- a/modules/openapi-generator-online/Dockerfile +++ b/modules/openapi-generator-online/Dockerfile @@ -1,4 +1,4 @@ -FROM eclipse-temurin:17.0.9_9-jre-focal +FROM eclipse-temurin:17.0.19_10-jre-resolute WORKDIR /generator From 4a5ce602f1dac8ef7108a12c605b792bbe2b4fd7 Mon Sep 17 00:00:00 2001 From: Shaun Hirst Date: Tue, 7 Jul 2026 16:30:42 +0100 Subject: [PATCH 2/2] fix(docker): use eclipse-temurin 17.0.19 on Ubuntu 24.04 (noble) instead of 26.04 (resolute) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The previous commit moved the base image to eclipse-temurin:17.0.19_10-jre-resolute (Ubuntu 26.04). Comparing all three candidates with `trivy image --severity HIGH,CRITICAL`: - eclipse-temurin:17.0.9_9-jre-focal (Ubuntu 20.04, current): trivy reports 0 findings, but only because Ubuntu 20.04 is EOL and Canonical no longer publishes security advisories for it — trivy itself warns detection is "insufficient". This is consistent with Snyk (which doesn't rely on distro-published advisories) flagging real CVEs, per #16791. - eclipse-temurin:17.0.19_10-jre-resolute (Ubuntu 26.04): 0 OS-package findings, and the OS itself is in-support. However its base layer bundles /usr/bin/pebble (Canonical's Go-based service manager, not a dpkg package), which carries 6 unpatched HIGH-severity CVEs (stale golang.org/x/net and stdlib crypto/x509, all with fixes already published upstream). Our entrypoint never invokes pebble, but it's still on disk and gets scanned, so it would likely reproduce the exact class of finding this fix is meant to close. - eclipse-temurin:17.0.19_10-jre-noble (Ubuntu 24.04 LTS, supported through 2029): same JRE 17.0.19 build, 0 HIGH/CRITICAL findings, no pebble binary, and a smaller image (89.9 MB vs 104.2 MB for resolute). Switch both Dockerfiles to the noble tag: it resolves the same focal/EOL problem as resolute without introducing a new set of live CVEs from a bundled binary we don't use, and Ubuntu 24.04 is a more conservative upgrade path than day-one 26.04. Refs #16791 --- modules/openapi-generator-cli/Dockerfile | 2 +- modules/openapi-generator-online/Dockerfile | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/modules/openapi-generator-cli/Dockerfile b/modules/openapi-generator-cli/Dockerfile index f3bc5199b576..97c98855edfb 100644 --- a/modules/openapi-generator-cli/Dockerfile +++ b/modules/openapi-generator-cli/Dockerfile @@ -1,4 +1,4 @@ -FROM eclipse-temurin:17.0.19_10-jre-resolute +FROM eclipse-temurin:17.0.19_10-jre-noble ADD target/openapi-generator-cli.jar /opt/openapi-generator/modules/openapi-generator-cli/target/openapi-generator-cli.jar diff --git a/modules/openapi-generator-online/Dockerfile b/modules/openapi-generator-online/Dockerfile index 51fdabdeb49a..d1147467ff8f 100644 --- a/modules/openapi-generator-online/Dockerfile +++ b/modules/openapi-generator-online/Dockerfile @@ -1,4 +1,4 @@ -FROM eclipse-temurin:17.0.19_10-jre-resolute +FROM eclipse-temurin:17.0.19_10-jre-noble WORKDIR /generator