From 4a60c7ec39894b6fb9777d1bc8de6288f267bd0a Mon Sep 17 00:00:00 2001
From: robbond <rob@rdbsolutions.co.uk>
Date: Fri, 6 Mar 2026 09:50:44 +0000
Subject: [PATCH] chore(deploy): harden docker base image patch level

---
 Dockerfile | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 698ec4c..ba8b59f 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,27 +1,29 @@
-FROM node:20-alpine AS deps
+FROM node:20.19.5-alpine3.22 AS deps
 WORKDIR /app
 
 COPY package.json package-lock.json ./
 RUN npm ci
 
-FROM node:20-alpine AS builder
+FROM node:20.19.5-alpine3.22 AS builder
 WORKDIR /app
 
 COPY --from=deps /app/node_modules ./node_modules
 COPY . .
 RUN npm run build
 
-FROM node:20-alpine AS prod-deps
+FROM node:20.19.5-alpine3.22 AS prod-deps
 WORKDIR /app
 
 COPY package.json package-lock.json ./
 RUN npm ci --omit=dev
 
-FROM node:20-alpine AS runner
+FROM node:20.19.5-alpine3.22 AS runner
 WORKDIR /app
 
 ENV NODE_ENV=production
 
+RUN apk upgrade --no-cache
+
 COPY --from=prod-deps /app/node_modules ./node_modules
 COPY --from=builder /app/package.json ./package.json
 COPY --from=builder /app/next.config.mjs ./next.config.mjs