From 0d59b737aa7a0200f8334cbfa29e5056390b4845 Mon Sep 17 00:00:00 2001
From: silverwind <me@silverwind.io>
Date: Fri, 6 Nov 2026 07:19:07 +0000
Subject: [PATCH] fix: upgrade Alpine base packages in Docker images (#40252)

The `alpine:3.24` base image lags behind fixes published to the Alpine
repository.

Both images now run `apk upgrade` before `apk add`. Packages from `apk
add` are already current, so this only affects the preinstalled base
packages.

_Written by Claude (Opus 5.5)._
---
 Dockerfile          | 2 +-
 Dockerfile.rootless | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 83f2be8bb58..b599beec94a 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -52,7 +52,7 @@ FROM docker.io/library/alpine:3.24 AS gitea
 
 EXPOSE 22 3000
 
-RUN apk --no-cache add \
+RUN apk --no-cache upgrade && apk --no-cache add \
     bash \
     ca-certificates \
     curl \
diff --git a/Dockerfile.rootless b/Dockerfile.rootless
index 4b10f517bdb..f18e1ade9ad 100644
--- a/Dockerfile.rootless
+++ b/Dockerfile.rootless
@@ -47,7 +47,7 @@ FROM docker.io/library/alpine:3.24 AS gitea-rootless
 
 EXPOSE 2222 3000
 
-RUN apk --no-cache add \
+RUN apk --no-cache upgrade && apk --no-cache add \
     bash \
     ca-certificates \
     dumb-init \