Add apk upgrade to fix OpenSSL CVEs in cached base image

[willyguggenheim]

Summary

• Add apk upgrade --no-cache to the final stage to ensure OS packages are current even when Docker layer cache serves a stale node:22-alpine base image

Motivation

The published Docker Hub image (mendhak/http-https-echo:latest) is on Alpine 3.23.2 with OpenSSL 3.5.4-r0 which has 2 CRITICAL and 4 HIGH CVEs:

• CVE-2025-15467 (CRITICAL) - Remote code execution or DoS via oversized initialization vectors
• CVE-2025-69419 (HIGH) - Arbitrary code execution via out-of-bounds write in PKCS#12 processing
• CVE-2025-69421 (HIGH) - DoS via malformed PKCS#12 file processing

These are fixed in OpenSSL 3.5.5-r0 (Alpine 3.23.3). The apk upgrade ensures the fix is picked up regardless of base image cache age.

Change

One-line addition to the existing RUN command in the final stage:

-RUN rm -rf /usr/local/lib/node_modules
+RUN apk upgrade --no-cache && rm -rf /usr/local/lib/node_modules

Test plan

• Local build with --no-cache succeeds
• Trivy image scan: 0 HIGH/CRITICAL across all targets
• Confirmed Docker Hub image (mendhak/http-https-echo:latest) has the 6 OpenSSL findings without this fix