From de5a2558ae0ffa76377be6967e2fb7e24ecfe337 Mon Sep 17 00:00:00 2001
From: Jan-Kazlouski-elastic <jan.kazlouski@elastic.co>
Date: Fri, 28 Aug 2026 11:55:27 +0300
Subject: [PATCH] fix(docker): bump runtime git apk to 2.54.0-r0 for
 CVE-2026-32631 (#486)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Part of https://github.com/elastic/security/issues/13623

Bump Wolfi runtime `git` apk pin from **2.50.1-r1** to **2.54.0-r0** to
resolve
[CVE-2026-32631](https://nvd.nist.gov/vuln/detail/CVE-2026-32631)
(information exposure in git).

### Scanner A/B (`CVE-2026-32631`)

Baseline: `git` **2.50.1-r1** → **2.54.0-r0** (Wolfi apk runtime
dependency).

Method: Trivy OS package scan on
`docker.elastic.co/integrations/crawler:1.0.0-SNAPSHOT` (before) vs
Wolfi base image with `git=~2.54.0-r0` installed (after — simulates
post-merge Dockerfile.wolfi pin).

| CVE | Severity | Issue | Before | After |
|-----|----------|-------|--------|-------|
| CVE-2026-32631 | Low |
[#13623](https://github.com/elastic/security/issues/13623) | reported
(`git@2.50.1-r1`) | clear (`git@2.54.0-r0`) |

**1/1 CVE: reported → clear.** Container re-publish + `snyk container
monitor` still needed for dashboard refresh.

### Checklists

#### Pre-Review Checklist
- [x] This PR does NOT contain credentials of any kind, such as API keys
or username/passwords (double check `crawler.yml.example` and
`elasticsearch.yml.example`)
- [x] This PR has a meaningful title
- [x] This PR links to all relevant GitHub issues that it fixes or
partially addresses
- [x] this PR has a thorough description
- [ ] Covered the changes with automated tests
- [x] Tested the changes locally (`make install-gems`, `make lint`,
`make test` — 690 examples, 0 failures)
- [x] Added a label for each target release version (example: `v0.1.0`)
- [ ] Considered corresponding documentation changes
- [ ] Contributed any configuration settings changes to the
configuration reference
- [ ] Ran `make notice` if any dependencies have been added

#### Changes Requiring Extra Attention

- [x] Security-related changes (encryption, TLS, SSRF, etc)

### Related Pull Requests

N/A

### Release Note

Bump Wolfi runtime git apk to 2.54.0-r0 to fix CVE-2026-32631
(information exposure).
---
 Dockerfile.wolfi | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Dockerfile.wolfi b/Dockerfile.wolfi
index d57723e4..c516b6d2 100644
--- a/Dockerfile.wolfi
+++ b/Dockerfile.wolfi
@@ -92,7 +92,7 @@ USER root
 
 # Create java user and install runtime dependencies
 RUN addgroup -g 1000 java && adduser -u 1000 -G java -s /bin/bash -D java && \
-    apk update && apk add --no-cache libcurl-openssl4=~8.12.1 git=~2.50.1-r1 bash=~5.3.0
+    apk update && apk add --no-cache libcurl-openssl4=~8.12.1 git=~2.54.0-r0 bash=~5.3.0
 
 # Set environment variables
 ENV JAVA_HOME=/opt/jdk-crawler \