fix(ui): drop apk upgrade and move the base digest forward (PROWLER-2323) (#12313)

tests/github/ui_e2e_workflow_test.py

@@ -3,7 +3,7 @@ from pathlib import Path
 REPOSITORY_ROOT = Path(__file__).parents[2]
 WORKFLOW_PATH = REPOSITORY_ROOT / ".github/workflows/ui-e2e-tests-v2.yml"
 NODE_IMAGE_DIGEST = (
-    "sha256:d1b3b4da11eefd5941e7f0b9cf17783fc99d9c6fc34884a665f40a06dbdfc94f"
+    "sha256:f70403e87646dc51b45295f4b8b70cdad0b63d2297c4c9899119b03f7af7a6b3"
 )
 
 

ui/.nvmrc

@@ -1 +1 @@
-24.15.0
+24.18.1

ui/Dockerfile

@@ -1,12 +1,13 @@
 # Keep in sync with ui/.nvmrc.
-FROM node:24.15.0-alpine@sha256:d1b3b4da11eefd5941e7f0b9cf17783fc99d9c6fc34884a665f40a06dbdfc94f AS base
+FROM node:24.18.1-alpine@sha256:f70403e87646dc51b45295f4b8b70cdad0b63d2297c4c9899119b03f7af7a6b3 AS base
 
 LABEL maintainer="https://github.com/prowler-cloud"
 
-# Patch Alpine OpenSSL runtime packages before all stages inherit the base image.
 # The build uses pnpm via corepack, so npm is unused — remove it (and npx) to drop
-# the bundled-npm CVE surface (node-tar CVE-2026-59873) from every stage, incl. prod.
-RUN apk upgrade --no-cache libcrypto3 libssl3 musl musl-utils zlib && corepack enable && rm -rf /usr/local/lib/node_modules/npm /usr/local/bin/npm /usr/local/bin/npx
+# the bundled-npm CVE surface from every stage, incl. prod.
+# No apk upgrade: it resolves against Alpine's live repo, so the digest pin above
+# would not make the image reproducible. Move the digest forward instead.
+RUN corepack enable && rm -rf /usr/local/lib/node_modules/npm /usr/local/bin/npm /usr/local/bin/npx
 
 # Install dependencies only when needed
 FROM base AS deps

ui/changelog.d/ui-reproducible-base.security.md

@@ -0,0 +1 @@
+Removed the `apk upgrade` from the UI image and moved the base digest forward instead, so the image is reproducible from its pin rather than from whatever Alpine serves at build time