GeezerVison

chore: update distroless image to fix CVE-2026-85091 (#62)

zlib1g@1:1.3.dfsg+really1.3.1-1+b1
zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.

fix: move base images to distroless cc-debian13 (#59)

Debian 12 (bookworm) is approaching the end of its full-support window, so
move the runtime base for both Java images to gcr.io/distroless/cc-debian13.

The helper stages move to trixie alongside it so the JRE and jemalloc are
built against the same glibc (2.41) as the runtime base, and the SSL stage
moves to java-base-debian13 so the Java cacerts come from a matching release.

cc-debian13 already ships zlib (libz.so.1 -> libz.so.1.3.1), unlike
cc-debian12, so copying libz in from the build stage is no longer needed.
Replace it with an assertion that the base still provides the library, left
unversioned so a routine zlib patch bump does not break the weekly
update-docker-args PR.

Verified by building both images on amd64 and arm64: java 11.0.33 and
21.0.13 start, jemalloc preloads, cacerts are present, and the eMudhra
blocked.certs entry survives jlink.

Co-authored-by: Claude Opus 5 <[email protected]>

fix: derive JAVA_FULL_VERSION from the real OpenJDK version, not the …

…Zulu build number (#58)

The java.version format changed to Azul's CDN filename style (e.g.
zulu11.92.109-ca-jdk11.0.33), which broke the cut-based parsing: it
produced tags like hypertrace/java:zulu11 and
hypertrace/java:zulu11.92.109 instead of updating hypertrace/java:11,
and JAVA_FULL_VERSION no longer matched the actual OpenJDK patch
version consumers expect (e.g. 11.0.33).

Co-authored-by: Claude Sonnet 5 <[email protected]>

fix: bump Zulu to 11.0.33 / 21.0.13 for eMudhra blocklist (#56)

Azul's out-of-cycle release of 2026-10-21 adds the compromised eMudhra
intermediates to blocked.certs. azul/zulu-openjdk-debian has no tag with
the fix yet, so fetch the Zulu CA build from cdn.azul.com, pinned by
SHA-256 for amd64 and arm64. java.version now holds the Zulu build name.
A build step fails if the fixed blocklist is missing from the jlinked JRE.

Co-authored-by: Claude Sonnet 5.5 <[email protected]>

Bump Java 11 base to Zulu 11.0.32.1 (11.90) for CVE-2026-46968 (#53)

Upgrade azul/zulu-openjdk-debian from 11.0.31-11.88 to 11.0.32.1-11.90
to address CVE-2026-46968 (JSSE TLS integrity vulnerability in Java 11.0.31
and earlier).

Co-authored-by: Cursor <[email protected]>

NO-TICKET: Bump Java 21 base to Zulu 21.0.12.1 (21.52) for openjdk-jr…

…e CVE fixes (#51)

Co-authored-by: Cursor <[email protected]>

Update base image SHA256 digest (#50)

* Update base image SHA256 digest

Update base image SHA256 digest (#49)

* Update base image SHA256 digest

* Update base.image

Update distroless base image for java images (#48)

chore: update base images and java versions (#47)

- Java 11: 11.0.30-11.86 -> 11.0.31-11.88
- Java 21: 21.0.10-21.48 -> 21.0.11-21.50
- distroless/cc-debian12:debug base image digest updated (resolves 1 CRITICAL, 4 HIGH OpenSSL CVEs)

Co-Authored-By: Claude Sonnet 4.6 <[email protected]>

AI-Session-Id: beace8af-00d2-476e-98ba-0b6f9d1b0cb7
AI-Tool: claude-code
AI-Model: unknown