alberto-art3ch opened a new pull request, #6693:
URL: https://github.com/apache/fineract/pull/6693
## Description
**Same JVM, smaller surface.** Both tags carry the same Zulu build
(25.0.4.1, `Zulu25.36+205-CA`) and the same 69 platform modules (including
`java.desktop` and `jdk.attach`). The headless variant drops the X11 native
libraries and the JDK development tools; `$JAVA_HOME/bin` keeps `java`, `jfr`,
`jwebserver`, `keytool` and `rmiregistry`. The tag is published for
`linux/amd64` and `linux/arm64`, so `publish-dockerhub.yml`
(`-Djib.from.platforms`) is unaffected.
**Vulnerabilities.** Trivy 0.75.0 (DB updated 2026-10-19), linux/amd64,
Fineract image built from `develop`:
| Base image | HIGH | MEDIUM | LOW | UNKNOWN | Image size |
|---|---|---|---|---|---|
| `25` (current) | 3 | 10 | 1 | 3 | 397 MB |
| `25-jre-headless` | 0 | 0 | 1 | 0 | 300 MB |
The three HIGH findings come with the base image, in X11 libraries that
Fineract does not use:
- CVE-2026-88806: `libx11` 1.8.13-r0, fixed in 1.8.14-r0
- CVE-2026-88807: `libxrender` 0.9.12-r0, fixed in 0.9.13-r0
- CVE-2026-94286: `libxtst` 1.2.5-r0, fixed in 1.2.6-r0
The remaining LOW finding (CVE-2025-46392, `commons-configuration` 1.10) is
an application dependency and is out of scope here.
**AWT in headless mode.** The only production code using AWT is
`ImageResizeContentProcessor` (`ImageIO` + `BufferedImage`), which works
headless. Verified locally on the new image with
`docker-compose-postgresql.yml`: uploaded a 1200×900 JPEG to
`/clients/{id}/images` and fetched it with
`?maxWidth=120&maxHeight=90&output=octet`; the result is a 120×90 JPEG, with no
`HeadlessException` or `UnsatisfiedLinkError` in the log. The container reaches
`healthy` (the `nc` healthcheck still works), and `actuator/health` and
`/api/v1/offices` return 200.
[FINERACT-2968](https://issues.apache.org/jira/browse/FINERACT-2968)
## Checklist
Please make sure these boxes are checked before submitting your pull request
- thanks!
- [ ] Write the commit message as per [our
guidelines](https://github.com/apache/fineract/blob/develop/CONTRIBUTING.md#pull-requests)
- [ ] Acknowledge that we will not review PRs that are not passing the build
_("green")_ - it is your responsibility to get a proposed PR to pass the build,
not primarily the project's maintainers.
- [ ] Create/update [unit or integration
tests](https://fineract.apache.org/docs/current/#_testing) for verifying the
changes made.
- [ ] Follow our [coding
conventions](https://cwiki.apache.org/confluence/display/FINERACT/Coding+Conventions).
- [ ] Add required Swagger annotation and update API documentation at
fineract-provider/src/main/resources/static/legacy-docs/apiLive.htm with
details of any API changes
- [ ] [This PR must not be a "code
dump"](https://cwiki.apache.org/confluence/display/FINERACT/Pull+Request+Size+Limit).
Large changes can be made in a branch, with assistance. Ask for help on the
[developer mailing list](https://fineract.apache.org/#contribute).
- [ ] If merging this PR resolves a JIRA issue, I will mark that issue as
resolved and set "Fix Version/s" appropriately.
- [ ] I followed the [AI
Policy](https://github.com/apache/fineract/blob/develop/CONTRIBUTING.md#ai-policy).
Your assigned reviewer(s) will follow our [guidelines for code
reviews](https://cwiki.apache.org/confluence/display/FINERACT/Code+Review+Guide).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
