From eb3d561c678b5b0ba14c4be61879d2b861d06027 Mon Sep 17 00:00:00 2001 From: Mark Ridgwell Date: Thu, 10 Sep 2026 19:12:50 +0100 Subject: [PATCH] chore: switch Docker base image to net11.0 GA runtime-deps tag mcr.microsoft.com/dotnet/runtime-deps:11.0-resolute-chiseled-extra now exists and pulls (verified; first attempt hit a transient 500 from MCR, retry succeeded). Trivy scan with the same gate flags CI uses (--vuln-type os,library --ignore-unfixed --severity HIGH,CRITICAL): 0 findings. Note: .NET 11 itself is still RC per global.json's pinned SDK (11.0.100-rc.1.26425.128), so this GA-tagged image may be a pre-provisioned alias rather than a finished release build. Do not merge until .NET 11 has actually GA'd and global.json's SDK pin is updated to match; see #407. Prompt: create a branch switching to it Claude-Session: https://claude.ai/code/session_01313QV1tQYNiHLrRRyaGVSg --- CHANGELOG.md | 1 + Dockerfile | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 27318142..fe394c96 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -76,6 +76,7 @@ Please ADD ALL Changes to the UNRELEASED SECTION and not a specific release - Update Docker base image to net11.0 preview runtime-deps (fixes CVE-2026-45447) - Dependencies - Updated FunFair.Test to 6.4.6.2749 - Dependencies - Updated FunFair.Test.Source.Generator to 6.4.6.2749 +- Switch Docker base image to the net11.0 GA runtime-deps tag ### Deprecated ### Removed - Removed NuGet audit suppressions for Scriban 6.2.0 vulnerabilities now that the transitive dependency has been dropped diff --git a/Dockerfile b/Dockerfile index e13dc4bd..affef2c4 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,6 +1,6 @@ # chiseled-extra is needed over chiseled for Discord #FROM mcr.microsoft.com/dotnet/runtime-deps:9.0-noble-chiseled-extra -FROM mcr.microsoft.com/dotnet/runtime-deps:11.0-preview-resolute-chiseled-extra +FROM mcr.microsoft.com/dotnet/runtime-deps:11.0-resolute-chiseled-extra WORKDIR /usr/src/app