deployment: bump Alpine version to v3.23.5 for security updates

See https://www.alpinelinux.org/posts/Alpine-3.22.5-3.23.5-released.html Signed-off-by: hagen1778 <roman@victoriametrics.com>
2026-06-27 12:37:29 +03:00 · 2026-06-26 14:17:23 +02:00
4 changed files with 6 additions and 4 deletions
--- a/.github/workflows/codeql-analysis-go.yml
+++ b/.github/workflows/codeql-analysis-go.yml
@@ -54,7 +54,7 @@ jobs:
          restore-keys: go-artifacts-${{ runner.os }}-codeql-analyze-${{ steps.go.outputs.go-version }}-

      - name: Initialize CodeQL
-        uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e  # v4.36.2
+        uses: github/codeql-action/init@e46ed2cbd01164d986452f91f178727624ae40d7  # v4.35.3
        with:
          languages: go

--- a/app/vmui/Dockerfile-web
+++ b/app/vmui/Dockerfile-web
@@ -6,7 +6,7 @@ COPY web/ /build/
 RUN GOOS=linux GOARCH=amd64 CGO_ENABLED=0 go build -o web-amd64 github.com/VictoriMetrics/vmui/ && \
    GOOS=windows GOARCH=amd64 CGO_ENABLED=0 go build -o web-windows github.com/VictoriMetrics/vmui/

-FROM alpine:3.23.4
+FROM alpine:3.23.5
 USER root

 COPY --from=build-web-stage /build/web-amd64 /app/web
--- a/deployment/docker/Makefile
+++ b/deployment/docker/Makefile
@@ -3,9 +3,9 @@
 DOCKER_REGISTRIES ?= docker.io quay.io
 DOCKER_NAMESPACE ?= victoriametrics

-ROOT_IMAGE ?= alpine:3.23.4
+ROOT_IMAGE ?= alpine:3.23.5
 ROOT_IMAGE_SCRATCH ?= scratch
-CERTS_IMAGE := alpine:3.23.4
+CERTS_IMAGE := alpine:3.23.5

 GO_BUILDER_IMAGE := golang:1.26.4

--- a/docs/victoriametrics/changelog/CHANGELOG.md
+++ b/docs/victoriametrics/changelog/CHANGELOG.md
@@ -26,6 +26,8 @@ See also [LTS releases](https://docs.victoriametrics.com/victoriametrics/lts-rel

 ## tip

+* SECURITY: upgrade base docker image (Alpine) from 3.23.4 to 3.23.5. See [Alpine 3.23.5 release notes](https://www.alpinelinux.org/posts/Alpine-3.22.5-3.23.5-released.html).
+
 * BUGFIX: `vmselect` in [VictoriaMetrics cluster](https://docs.victoriametrics.com/victoriametrics/cluster-victoriametrics/): propagate cache reset operation to `selectNode` when `/internal/resetRollupResultCache` is called. Previously, the propagation only happened when the `delete_series` API was called. See [#11112](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/11112).
 * BUGFIX: [stream aggregation](https://docs.victoriametrics.com/victoriametrics/stream-aggregation/): fix possible unexpected increases in `rate_avg` and `rate_sum` if an out-of-order sample is ingested after the previous flush. See [#11140](https://github.com/VictoriaMetrics/VictoriaMetrics/pull/11140).