From 64e56cb761f0679b639d5543acb60cdff9242c34 Mon Sep 17 00:00:00 2001 From: Gonzalo Rojas Date: Mon, 14 Sep 2026 14:11:34 -0300 Subject: [PATCH 1/2] fix(deps): bump OpenTofu to 1.12.6 The pinned build is compiled with an old Go toolchain, so Trivy reports its vendored stdlib and x/* modules as vulnerable. Measured against the published image: 51 fixable CRITICAL/HIGH findings on the current pin, 13 on 1.12.6. Both linux/amd64 and linux/arm64 artifacts verified present. Co-Authored-By: Claude Opus 5 --- Dockerfile.rds-postgres-db | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile.rds-postgres-db b/Dockerfile.rds-postgres-db index 9e50d27..29145e6 100644 --- a/Dockerfile.rds-postgres-db +++ b/Dockerfile.rds-postgres-db @@ -6,7 +6,7 @@ FROM public.ecr.aws/nullplatform/scopes/worker-bridge:1.0.0 RUN apk add --no-cache aws-cli gomplate postgresql16-client -ARG TOFU_VERSION=1.10.10 +ARG TOFU_VERSION=1.12.6 ARG TARGETARCH RUN curl -fsSL "https://github.com/opentofu/opentofu/releases/download/v${TOFU_VERSION}/tofu_${TOFU_VERSION}_linux_${TARGETARCH}.tar.gz" \ | tar -xz -C /usr/local/bin tofu \ From 7d5cfab1a1b20c82fc832b109df730288c8c58f1 Mon Sep 17 00:00:00 2001 From: Gonzalo Rojas Date: Mon, 14 Sep 2026 14:11:36 -0300 Subject: [PATCH 2/2] fix(deps): bump OpenTofu to 1.12.6 The pinned build is compiled with an old Go toolchain, so Trivy reports its vendored stdlib and x/* modules as vulnerable. Measured against the published image: 51 fixable CRITICAL/HIGH findings on the current pin, 13 on 1.12.6. Both linux/amd64 and linux/arm64 artifacts verified present. Co-Authored-By: Claude Opus 5 --- Dockerfile.rds-postgres-server | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile.rds-postgres-server b/Dockerfile.rds-postgres-server index 2e08d4b..5356658 100644 --- a/Dockerfile.rds-postgres-server +++ b/Dockerfile.rds-postgres-server @@ -7,7 +7,7 @@ FROM public.ecr.aws/nullplatform/scopes/worker-bridge:1.0.0 RUN apk add --no-cache aws-cli gomplate # OpenTofu >= 1.10 (S3 backend with use_lockfile); alpine packages 1.7.x. -ARG TOFU_VERSION=1.10.10 +ARG TOFU_VERSION=1.12.6 ARG TARGETARCH RUN curl -fsSL "https://github.com/opentofu/opentofu/releases/download/v${TOFU_VERSION}/tofu_${TOFU_VERSION}_linux_${TARGETARCH}.tar.gz" \ | tar -xz -C /usr/local/bin tofu \