Fix CVE-2025-9230 by applying image updates (#511)

Author: mgruner

.env.dist

@@ -11,19 +11,19 @@
 
 # Use a fixed Zammad version rather than the default. If you do so,
 #   you are responsible to update this to newer patch level versions yourself.
-# VERSION=6.5.2
+# VERSION=6.5.2-22
 # You can also use floating versions that will give you automatic updates:
 # VERSION=6.2     # all patchlevel updates
 # VERSION=6       # including minor updates
 # VERSION=latest  # all updates of stable versions, including major
 # VERSION=develop # bleeding-edge development version
 # IMAGE_REPO=ghcr.io/zammad/zammad
 
-# ELASTICSEARCH_VERSION=8.19.4
+# ELASTICSEARCH_VERSION=8.19.6
 # MEMCACHE_SERVERS=zammad-memcached:11211
 # MEMCACHE_VERSION=1.6.39-alpine
 # REDIS_URL=redis://zammad-redis:6379
-# REDIS_VERSION=7.4.5-alpine
+# REDIS_VERSION=7.4.6-alpine
 # POSTGRES_VERSION=17.6-alpine
 
 # RAILS_TRUSTED_PROXIES=

.github/updatecli.yaml

@@ -6,9 +6,9 @@ sources:
     spec:
       image: "zammad/zammad-docker-compose"
       architecture: "linux/amd64"
-      tagfilter: "^6\\.5\\.2$"
+      # tagfilter: "^6\\.5\\.2$"
       # tagfilter: "^6\\.5\\.2-\\d{1}"
-      # tagfilter: "^6\\.5\\.2-\\d{2}"
+      tagfilter: "^6\\.5\\.2-\\d{2}"
       # tagfilter: "^6\\.5\\.2-\\d{3}"
   elasticsearch:
     kind: dockerimage

docker-compose.yml

@@ -52,7 +52,7 @@ x-shared:
       LETSENCRYPT_HOST:
       LETSENCRYPT_EMAIL:
 
-    image: ${IMAGE_REPO:-ghcr.io/zammad/zammad}:${VERSION:-6.5.2}
+    image: ${IMAGE_REPO:-ghcr.io/zammad/zammad}:${VERSION:-6.5.2-22}
     restart: ${RESTART:-always}
     volumes:
       - zammad-storage:/opt/zammad/storage
@@ -71,7 +71,7 @@ services:
     user: 0:0
 
   zammad-elasticsearch:
-    image: elasticsearch:${ELASTICSEARCH_VERSION:-8.19.4}
+    image: elasticsearch:${ELASTICSEARCH_VERSION:-8.19.6}
     restart: ${RESTART:-always}
     volumes:
       - elasticsearch-data:/usr/share/elasticsearch/data
@@ -118,7 +118,7 @@ services:
     command: ["zammad-railsserver"]
 
   zammad-redis:
-    image: redis:${REDIS_VERSION:-7.4.5-alpine}
+    image: redis:${REDIS_VERSION:-7.4.6-alpine}
     restart: ${RESTART:-always}
     volumes:
       - redis-data:/data