Charles BochetandGitHub
14acd77626
## Summary - ECR Inspector flagged 9 CVEs on the `prod-twenty` image — 8 PostgreSQL CVEs on `postgresql18-18.3-r0` (pulled in transitively by `apk add postgresql-client`) and CVE-2026-27135 on `nghttp2-1.68.0-r0` (pulled in by `curl` / `aws-cli`). - Alpine 3.23 already ships patched `postgresql18-18.4-r0` and `nghttp2-1.69.0-r0`, but the GHA buildx cache was reusing the stale `apk add` layer because `FROM node:24-alpine` had not moved. - Pinning the base image to `node:24.15.0-alpine3.23@sha256:8e2c930f…` forces a layer cache miss, picks up the patched apk packages, and gives Dependabot/Renovate a stable target for future digest bumps. Applied to both [packages/twenty-docker/twenty/Dockerfile](https://github.com/twentyhq/twenty/blob/charles/trusting-solomon-259ec8/packages/twenty-docker/twenty/Dockerfile) (4 stages → ECR `prod-twenty`) and [packages/twenty-docker/twenty-website-new/Dockerfile](https://github.com/twentyhq/twenty/blob/charles/trusting-solomon-259ec8/packages/twenty-docker/twenty-website-new/Dockerfile) (2 stages). ## Test plan - [ ] CI builds both images successfully on amd64 + arm64 - [ ] After merge + deploy, re-run ECR Inspector on the new `prod-twenty` image and confirm the 9 CVEs (CVE-2026-6473/6474/6475/6476/6477/6478/6479/6637 + CVE-2026-27135) are gone - [ ] Smoke-test the staging deployment (server boot, DB migrations via `psql` in the entrypoint)