[ADMINAPI-1321] - Docker Security Vulnerability Remediation - .net 8.0.21

[DavidJGapCR]

No description provided.

[github-actions]

🔍 Vulnerabilities of development:latest

📦 Image Reference development:latest

digest	sha256:3d765acfb1dd740b6504f585de23260cae61412c74ae10cc7099658347ff7412
vulnerabilities
platform	linux/amd64
size	90 MB
packages	593

📦 Base Image alpine:3.21

also known as	3.21.5 d7d2af10dd52b47735f4b5abdb91ff534bffee8495cd5b3f588a14c7389c6676
digest	sha256:41c81533144786e0beb2b148667355a6c7659aa99a14ed837ff15a98ca9d71f3
vulnerabilities

busybox 1.37.0-r13 (apk) pkg:apk/alpine/busybox@1.37.0-r13?os_name=alpine&os_version=3.21 Affected range <=1.37.0-r13 Fixed version Not Fixed Description Affected range <=1.37.0-r13 Fixed version Not Fixed Description

lz4 1.10.0-r0 (apk) pkg:apk/alpine/lz4@1.10.0-r0?os_name=alpine&os_version=3.21 Affected range <=1.10.0-r0 Fixed version Not Fixed Description

[Copilot]

Pull Request Overview

This PR updates Docker base images and package versions across all Dockerfiles, upgrading from Alpine 3.20 to Alpine 3.21, .NET SDK from 8.0.403 to 8.0.415, and .NET ASP.NET runtime from 8.0.8/8.0.10 to 8.0.21. It also updates various Alpine package versions including musl, bash, and PostgreSQL client.

Key changes:

• Upgraded Alpine base image from 3.20 to 3.21 with updated SHA256 hashes
• Updated .NET SDK and ASP.NET runtime to latest versions (8.0.415 and 8.0.21)
• Updated Alpine package versions (musl from 1.2.5-r1 to 1.2.5-r9, PostgreSQL client from version 14 to 15)

Reviewed Changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
Docker/dev.pgsql.Dockerfile	Updates Alpine 3.21, .NET 8.0.415/8.0.21, package versions, and PostgreSQL 15 client
Docker/dev.mssql.Dockerfile	Updates Alpine 3.21, .NET 8.0.415/8.0.21, and musl package version
Docker/api.pgsql.Dockerfile	Updates Alpine 3.21, .NET 8.0.21, package versions, and PostgreSQL 15 client
Docker/api.mssql.Dockerfile	Updates Alpine 3.21, .NET 8.0.21, and musl package version

Comments suppressed due to low confidence (1)

Docker/api.pgsql.Dockerfile:1

• The icu package version (74.2-r1) is pinned in dev.pgsql.Dockerfile line 44 but uses a looser version constraint (icu=~74) here. Consider using a consistent versioning approach across all Dockerfiles for better maintainability and reproducibility.

# SPDX-License-Identifier: Apache-2.0