From 4e91dc2db53a76d04a1333a0eab3a434acacb63b Mon Sep 17 00:00:00 2001 From: Gonzalo Rojas Date: Mon, 14 Sep 2026 14:11:10 -0300 Subject: [PATCH] fix(deps): bump OpenTofu to 1.12.6 The pinned build is compiled with an old Go toolchain, so Trivy reports its vendored stdlib and x/* modules as vulnerable. Measured against the published image: 51 fixable CRITICAL/HIGH findings on the current pin, 13 on 1.12.6. Both linux/amd64 and linux/arm64 artifacts verified present. Co-Authored-By: Claude Opus 5 --- Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index f016816..828e8ed 100644 --- a/Dockerfile +++ b/Dockerfile @@ -14,7 +14,7 @@ RUN apk add --no-cache aws-cli gomplate # OpenTofu >= 1.10 — the service inits its S3 backend with use_lockfile=true, # which needs tofu 1.10+. alpine only packages 1.7.x, so pull the official # static binary for the build arch. -ARG TOFU_VERSION=1.10.10 +ARG TOFU_VERSION=1.12.6 ARG TARGETARCH RUN curl -fsSL "https://github.com/opentofu/opentofu/releases/download/v${TOFU_VERSION}/tofu_${TOFU_VERSION}_linux_${TARGETARCH}.tar.gz" \ | tar -xz -C /usr/local/bin tofu \