[DoDiODev]

Summary

All three release images ship a Brotli library that is vulnerable to
CVE-2026-111497 (out-of-bounds write in the decoder, CVSS 9.2 Critical).
New base image tags do not fix it yet:

Image	Base	Brotli in base tag	Fixed
devlake	python:3.11-slim-bookworm (pulled in by curl & co.)	libbrotli1 1.0.9-2+b6	1.0.9-2+deb12u1
devlake-config-ui	nginxinc/nginx-unprivileged:1.31.6 / 1.31.7	libbrotli1 1.1.0-2+b7	1.1.0-2+deb13u1
devlake-dashboard	grafana/grafana:13.2.4 (Alpine 3.24.2)	brotli-libs 1.2.0-r1	1.2.1-r0

This PR upgrades the OS packages when the image is built:

• backend/Dockerfile: apt-get upgrade -y in the base stage
• config-ui/Dockerfile: apt-get upgrade -y. I also switched apt to apt-get
  (stable CLI for scripts) and clean the apt lists
• grafana/Dockerfile: apk upgrade --no-cache in the existing USER root step

This also picks up future Debian/Alpine security fixes on every rebuild. We
do not have to wait for upstream base images.

Does this close any open issues?

Closes #9258

Screenshots

N/A

Other Information

Verified locally (linux/arm64, 2026-10-27):

devlake (--target base)   libbrotli1 1.0.9-2+deb12u1
devlake-config-ui         libbrotli1 1.1.0-2+deb13u1   (htpasswd, ip present; runs as uid 101)
devlake-dashboard         brotli-libs-1.2.1-r0         (runs as uid 101)

Dependabot #9253 (nginx-unprivileged 1.31.6 → 1.31.7) touches a different line
in config-ui/Dockerfile, so the two PRs do not conflict. On its own, #9253 does
not fix the CVE, because 1.31.7 still ships libbrotli1 1.1.0-2+b7.

The reporter asked for a new release or a re-push of v1.0.3-beta18 with the
fixed packages. After this PR is merged, that needs a maintainer to rebuild and publish the images.