From 7e9187439c61f1422d6926c928b312f3e4b20cfa Mon Sep 17 00:00:00 2001
From: mayankpande88 <mayankpande88@gmail.com>
Date: Thu, 9 Jul 2026 22:41:39 +0530
Subject: [PATCH] security: build with go 1.25.11 + microdnf update UBI9 base
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Takes the node-agent image from 94 fixable CVEs to 8 (CRITICAL 0):
- GO_VERSION 1.25.0 -> 1.25.11 clears the Go stdlib CRITICAL (CVE-2025-68121)
  and all stdlib HIGH/MEDIUM in the nudgebee-node-agent binary.
- `microdnf update` patches the pinned ubi9/ubi-minimal base (gnutls,
  openssl-libs, glibc, krb5-libs, ...) which shipped stale.
- The rebuild also picks up main's already-bumped modules (x/net v0.55.0,
  containerd v1.7.33, mongo-driver v1.17.9, otel v1.44.0, cilium v1.17.15).

Verified: rebuilt image scans 8 fixable / 0 CRITICAL (was 94); the agent
binary runs (`nudgebee-node-agent --help`).

The remaining 8 are risky/large go-module bumps (docker v28->v29 major,
prometheus v0.51->v0.311, cilium 1.17.16, xz 0.5.15) that need coroot-fork
alignment + integration testing — deferred to a separate dependency PR.
---
 Dockerfile | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index b0544bf..341219e 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -5,7 +5,7 @@ FROM debian:bullseye AS builder
 RUN apt-get update && apt-get install -y \
     curl git build-essential pkg-config libsystemd-dev
 
-ARG GO_VERSION=1.25.0
+ARG GO_VERSION=1.25.11
 RUN curl -fsSL https://go.dev/dl/go${GO_VERSION}.linux-$(dpkg --print-architecture).tar.gz -o go.tar.gz && \
     tar -C /usr/local -xzf go.tar.gz && rm go.tar.gz
 ENV PATH="/usr/local/go/bin:${PATH}"
@@ -22,8 +22,12 @@ FROM registry.access.redhat.com/ubi9/ubi-minimal AS runtime
 
 ARG VERSION=unknown
 
-# Install SSL/TLS libraries for HTTPS LLM API tracing
-RUN microdnf install -y openssl-libs
+# Patch the UBI9 base to the latest package set, then install SSL/TLS libraries
+# for HTTPS LLM API tracing. microdnf update clears the fixable RedHat OS CVEs
+# (gnutls, openssl-libs, glibc, krb5-libs, ...) the pinned ubi-minimal ships stale.
+RUN microdnf update -y && \
+    microdnf install -y openssl-libs && \
+    microdnf clean all
 
 COPY --from=builder /tmp/src/nudgebee-node-agent /usr/bin/nudgebee-node-agent