Security: stable v0.30.8 still ships [email protected] (critical RCE advisories), and image base/tooling carry fixable CVEs #5736

To Reproduce

1. Check apps/dokploy/package.json on main (v0.30.8): "next": "16.3.0".
2. Scan the published images, e.g. trivy image --scanners vuln --severity HIGH,CRITICAL --ignore-unfixed dokploy/dokploy:v0.30.7 and dokploy/dokploy:canary.

Current vs. Expected behavior

Current — stable release (main / v0.30.8) still ships [email protected], which is affected by public critical advisories:

These are already fixed on canary by #5517, but that hasn't reached a release yet (release PR #5689 is still open). Since the Dokploy UI is usually internet-facing and has access to the Docker socket, an RCE here means full host compromise.

Current — canary: the JS dependencies are clean, but the image is still built on pinned, older tooling that carries HIGH/CRITICAL fixable CVEs:

• node:24.4.0-slim base (July 2025, Debian 12.11): the Node.js runtime has received many security releases since (latest is 24.22.1), and OS packages are stale (libgnutls30 with CRITICAL CVE-2026-42010 auth bypass, libpam* CVE-2025-6020, libpcre2-8-0, gpgv, git-lfs).
• [email protected] (installed in the runtime image via corepack): 14 HIGH advisories, fixed in 10.34.x.
• buildpacksio/pack:0.39.1: Go 1.25.5 stdlib (CRITICAL), golang.org/x/crypto 0.45, go-git 5.16.4, buildkit 0.26.1, containerd …
• railpack 0.15.4 (Go 1.23.4, grpc 1.68.1 CRITICAL CVE-2026-33186) and Docker 28.5.2 (dockerd: Go 1.25.3, grpc 1.72.2, containerd 2.1.4). These need a bigger, behaviour-affecting bump so I'm only flagging them here.

Expected:

1. A patch release that ships Dependabots alerts fixes #5517 (Next.js 16.3.8 and friends) to stable.
2. The image base / bundled tooling bumped so the published image doesn't ship known-fixed CVEs.

Provide environment information

Dokploy: v0.30.7 (self-hosted, Docker Swarm) scanned; v0.30.8 checked via main's package.json (next 16.3.0); dokploy/dokploy:canary image (built 2026-10-16) scanned
OS: Ubuntu 24.04, kernel 6.8
Scanner: Trivy (latest DB, 2026-10-22), HIGH/CRITICAL with a fix available only

Which area(s) are affected?

Installation, Docker

Are you deploying the applications where Dokploy is installed or on a remote server?

Same server where Dokploy is installed

Additional context

All of the above are publicly disclosed CVEs in third-party dependencies (no new Dokploy-specific vulnerability), hence a public issue. Previous similar reports: #3225, #3171.

Will you send a PR to fix it?

Yes — PR for point 2 (Node base image, pnpm, pack) coming up against canary.