[BRONSOLO]

Fixes CVE-2026-111497 (Brotli), CVE-2026-114406 (eMudhra roots) and CVE-2026-111943 (Go crypto/x509) in the DE 5.8 postgres-operator image (DASH-2660, DASH-2715). The operator code stays at upstream v1.15.1 plus the dekn#5927 change.

Changes

• The build fails unless brotli-libs is at least 1.2.1-r0. The image in DE 5.8.10, v1.15.1_w-o_sec_validation, has 1.2.0-r1.
• The base image is pinned to alpine:3.24 instead of latest. apk -U upgrade installs ca-certificates-bundle 20261020-r0, which removes the eMudhra roots.
• The builder moves from golang:1.25-alpine to golang:1.27.3-alpine. Go 1.27.3 has the crypto/x509 fix.

Testing

Built on arm64. The image has Alpine 3.24.3, ca-certificates-bundle 20261020-r0 and brotli-libs 1.2.1-r0. The binary reports go1.27.3 and --help runs. On Alpine 3.21 the brotli check fails as intended.

After merge

Build and push the image manually under a new tag. Do not reuse v1.15.1_w-o_sec_validation. Then bump the tag in dek-deployment 5.8-release:

docker buildx build --platform linux/amd64,linux/arm64 -f docker/Dockerfile \
  --build-arg VERSION=<tag> -t quay.io/plotly/postgres-operator:<tag> --push .

[coveralls]

Coverage Report for CI Build 41851037316

Warning

No base build found for commit 1ee805f on v1.15.1_w-o_sec_validation.
Coverage changes can't be calculated without a base build.
If a base build is processing, this comment will update automatically when it completes.

Coverage: 42.23%

Details

• Patch coverage: No coverable lines changed in this PR.

Uncovered Changes

No uncovered changes found.

Coverage Regressions

Requires a base build to compare against. How to fix this →

---

Coverage Stats

Relevant Lines:	15489
Covered Lines:	6541
Line Coverage:	42.23%
Coverage Strength:	15.56 hits per line

---

💛 - Coveralls