From 35341d0793d43c256ee2b1c7c8dbc9a6999fd6f6 Mon Sep 17 00:00:00 2001
From: "linear-code[bot]" <222613912+linear-code[bot]@users.noreply.github.com>
Date: Tue, 14 Jul 2026 13:40:40 +0000
Subject: [PATCH 1/2] chore: pin curl/libcurl to ^8.20.0-r0 to address
 CVE-2026-6276

Fixes SOU-1506

Addresses CVE-2026-6276 (libcurl cookie leak on connection reuse with
custom Host headers), flagged by Trivy against the Docker image's
curl/libcurl (installed 8.19.0-r0, fixed in 8.20.0-r0).

The runner stage already runs apk upgrade --no-cache and Alpine 3.23
ships the patched curl 8.20.0-r0, but the scan reflects a build from
before it was published. Pin curl and libcurl to >=8.20.0-r0 in the
runner apk add so the patched version is required explicitly.

Generated with [Linear](https://linear.app/sourcebot/issue/SOU-1506/sourcebot-devsourcebot-cve-2026-6276-curl-libcurl-information#agent-session-8984563e)

Co-authored-by: linear-code[bot] <222613912+linear-code[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 3 +++
 Dockerfile   | 5 ++++-
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index c1df382b6..3916a4ac6 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Fixed
+- Pinned `curl`/`libcurl` to `>=8.20.0-r0` in the Docker image to address CVE-2026-6276. [#1447](https://github.com/sourcebot-dev/sourcebot/pull/1447)
+
 ## [5.1.1] - 2026-07-14
 
 - Add book a call button to sidebar. [#1441](https://github.com/sourcebot-dev/sourcebot/pull/1441)
diff --git a/Dockerfile b/Dockerfile
index 4a1b016c7..2d7ca781c 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -166,7 +166,10 @@ ENV SOURCEBOT_LOG_LEVEL=info
 # ENV SOURCEBOT_TELEMETRY_DISABLED=1
 
 # Configure dependencies
-RUN apk add --no-cache git ca-certificates bind-tools tini jansson wget supervisor uuidgen curl perl jq openssl util-linux unzip && \
+# curl/libcurl are pinned to >=8.20.0-r0 to ensure CVE-2026-6276 (cookie leak
+# on connection reuse with custom Host headers) is patched. `apk upgrade`
+# additionally pulls in the latest patched versions of the other packages.
+RUN apk add --no-cache git ca-certificates bind-tools tini jansson wget supervisor uuidgen "curl>=8.20.0-r0" "libcurl>=8.20.0-r0" perl jq openssl util-linux unzip && \
     apk upgrade --no-cache
 
 # Remove npm (unused — we use Yarn). The Node.js base image bundles npm

From ce7408692d1aebd926d4f5953d1719aeb615cf84 Mon Sep 17 00:00:00 2001
From: "linear-code[bot]" <222613912+linear-code[bot]@users.noreply.github.com>
Date: Tue, 14 Jul 2026 13:41:02 +0000
Subject: [PATCH 2/2] chore: correct CHANGELOG PR link to #1449

Generated with [Linear](https://linear.app/sourcebot/issue/SOU-1506/sourcebot-devsourcebot-cve-2026-6276-curl-libcurl-information#agent-session-8984563e)

Co-authored-by: linear-code[bot] <222613912+linear-code[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3916a4ac6..d1e628285 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,7 +8,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [Unreleased]
 
 ### Fixed
-- Pinned `curl`/`libcurl` to `>=8.20.0-r0` in the Docker image to address CVE-2026-6276. [#1447](https://github.com/sourcebot-dev/sourcebot/pull/1447)
+- Pinned `curl`/`libcurl` to `>=8.20.0-r0` in the Docker image to address CVE-2026-6276. [#1449](https://github.com/sourcebot-dev/sourcebot/pull/1449)
 
 ## [5.1.1] - 2026-07-14