From 2aae718dcc2bc045288ff0c61e4ba8cbafc12c0b Mon Sep 17 00:00:00 2001
From: JuanTorchia <>
Date: Thu, 6 Aug 2026 18:11:49 +0000
Subject: [PATCH] chore(docker): bump cloudflared to 2026.7.3

The pinned cloudflared 2025.7.0 is built with Go 1.24.4 and grpc
v1.72.2, which carry two CRITICAL vulnerabilities:

- CVE-2025-68121 (crypto/tls: incorrect certificate validation
  during TLS session resumption), fixed in Go 1.24.13
- CVE-2026-33186 (grpc-go authz: authorization bypass due to
  improper HTTP/2 path validation), fixed in grpc 1.79.3

cloudflared 2026.7.3 ships patched Go/grpc; a Trivy scan of the
official linux-amd64 binary reports zero CRITICAL findings.
---
 docker/production/Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docker/production/Dockerfile b/docker/production/Dockerfile
index 34e4b6789..263788e4d 100644
--- a/docker/production/Dockerfile
+++ b/docker/production/Dockerfile
@@ -4,7 +4,7 @@ ARG SERVERSIDEUP_PHP_VERSION=8.4-fpm-nginx-alpine
 # https://github.com/minio/mc/releases
 ARG MINIO_VERSION=RELEASE.2025-05-21T01-59-54Z
 # https://github.com/cloudflare/cloudflared/releases
-ARG CLOUDFLARED_VERSION=2025.7.0
+ARG CLOUDFLARED_VERSION=2026.7.3
 # https://www.postgresql.org/support/versioning/
 # Note: We are using version 18 of the postgres client (while still using postgres 15 for the postgres server) as version 15 has been removed from Alpine 3.23+ https://pkgs.alpinelinux.org/packages?name=postgresql*-client&branch=v3.23&repo=&arch=x86_64&origin=&flagged=&maintainer=
 ARG POSTGRES_VERSION=18