From 48147465b5b2ea682069d8736f24d054725ef957 Mon Sep 17 00:00:00 2001
From: NuklearRabbit <145918611+NuklearRabbit@users.noreply.github.com>
Date: Tue, 1 Sep 2026 21:19:48 +0200
Subject: [PATCH] security: refresh Alpine runtime packages

---
 frontend/Dockerfile | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/frontend/Dockerfile b/frontend/Dockerfile
index cf38a80..fb2d964 100644
--- a/frontend/Dockerfile
+++ b/frontend/Dockerfile
@@ -11,6 +11,9 @@ ENV VITE_API_BASE_URL=$VITE_API_BASE_URL
 RUN npm run build
 
 FROM nginx:1.30.4-alpine@sha256:97d490c12ba55b4946b01546d1c3ed324e8d41ab1c9fcb2a616aa470620e5b46
+# The pinned upstream image can lag Alpine security rebuilds. Apply the current
+# fixes from its pinned Alpine release before shipping the runtime image.
+RUN apk upgrade --no-cache
 ARG VCS_REF=development
 ARG BUILD_DATE=unknown
 LABEL org.opencontainers.image.title="Fleet Ops Web" \