From 09e32c11860311b7590ea45189bb393e94b118d7 Mon Sep 17 00:00:00 2001
From: "atomicbackspace-agent[bot]"
 <330986079+atomicbackspace-agent[bot]@users.noreply.github.com>
Date: Sat, 7 Nov 2026 11:03:40 +0100
Subject: [PATCH] fix: upgrade brotli-libs and gate on it (KEV CVE-2026-111497)

The forgejo/runner:12.11.1 base ships brotli-libs 1.2.0-r0, and `apk add`
never upgrades a package the base already has. Upgrade it explicitly
(-> 1.2.1-r0) and fail the build if it is still older, so a base bump
cannot bring the vulnerable version back. Markus approved 2026-11-07.

Tested locally: builds for linux/amd64 and linux/arm64,
"Upgrading brotli-libs (1.2.0-r0 -> 1.2.1-r0)", gate passes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 Dockerfile | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/Dockerfile b/Dockerfile
index 72d1cd9..9e338c3 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -93,5 +93,17 @@ RUN apk add --no-cache \
       font-noto \
       postgresql-client
 
+# CVE-2026-111497 (brotli decoder out-of-bounds write, CISA KEV, due 2026-11-10): the
+# forgejo/runner:12.11.1 base ships brotli-libs 1.2.0-r0, and `apk add` above never
+# upgrades a package the base already has. git-remote-http and curl link it through
+# libcurl. Upgrade it explicitly and fail the build if it is still behind, so a base
+# bump can never quietly bring the vulnerable version back. Drop this once the upstream
+# runner base ships brotli-libs >= 1.2.1.
+RUN set -eux; \
+    apk upgrade --no-cache brotli-libs; \
+    v="$(apk list --installed brotli-libs | sed -n 's/^brotli-libs-\([0-9][^ ]*\) .*/\1/p')"; \
+    echo "brotli-libs ${v}"; \
+    [ "$(apk version -t "${v}" 1.2.1-r0)" != "<" ] || { echo "brotli-libs ${v} is older than 1.2.1-r0 (CVE-2026-111497)"; exit 1; }
+
 # Match the runner pod's runAsUser (1000); keep the image non-root by default.
 USER 1000