Repository navigation
build(docker): Bump image base to Alpine 3.22.7 - #3462
Merged
Merged
Conversation
Alpine 3.22.7 already ships ca-certificates 20261020-r0, which drops the distrusted eMudhra/emSign roots, so the base image is clean and the ca-certificates version pin added in #3447 is no longer needed. Refs VULN-3216 Co-Authored-By: Geoff Goldsmith <[email protected]>
sentry-junior
Bot
requested review from
a team and
szokeasaurusrex
as code owners
October 27, 2026 19:31
BYK
approved these changes
Oct 27, 2026
BYK
approved these changes
Oct 27, 2026
The 3.8.2 post-release step timed out waiting for @sentry/cli-linux-arm64 on npm, so package-lock.json still pinned the platform packages to 3.8.1 and npm ci failed. Co-Authored-By: Geoff Goldsmith <[email protected]>
szokeasaurusrex
approved these changes
Oct 28, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This follows up on #3447 and is tracked in VULN-3216. #3447 kept the
alpine:3.22.0base and forcedca-certificates>=20261020-r0throughapkto drop the distrusted eMudhra/emSign roots. Alpine 3.22.7 now ships that package in the base image, so this replaces the pin with a base image bump.Dockerfile: the runtime stage moves fromalpine:3.22.0@sha256:8a1f59ff…toalpine:3.22.7@sha256:2e0b81d6…, still digest-pinned.apk add ca-certificatesgoes back to unpinned.CHANGELOG.md: adds an Unreleased internal-changes entry.package-lock.json: bumps the@sentry/cli-*optional dependencies from 3.8.1 to 3.8.2. This is unrelated to the Docker change. It fixes the Node CI jobs, which have failed onmastersince the 3.8.2 release, and is included here to unblock this PR. The 3.8.2 post-release step (publish run) gave up after its 30-minute wait for@sentry/[email protected], which reached npm about 54 minutes after@sentry/cli. Because of that, the lockfile was never bumped andnpm cirejected it as out of sync withpackage.json. I regenerated it withnpm install --package-lock-only --ignore-scripts --prefer-online(npm 11.6.0, the Volta pin). The only change is the 8 platform entries, which now also carryresolvedandintegrity, checked against the registry.Checked locally: I built the runtime stage, without the binary copy.
ca-certificatesandca-certificates-bundlecome out at20261020-r0. The builder stage (rust:1.91.1-alpine3.20) is unchanged. It doesn't ship. With the new lockfile,npm ci --ignore-scripts,npm run check:types, andnpm run buildpass.via Geoff Goldsmith.
--
View Junior Session [Sentry]