Docker image includes Debian perl-base packages with unresolved CVEs

[AndrewDucDanhDo]

Summary

The official graphprotocol/graph-node:v0.41.0 container image uses Debian
Bookworm as its runtime base:

https://github.com/graphprotocol/graph-node/blob/v0.41.0/docker/Dockerfile

A container scan reports that the runtime image includes Debian's perl-base
package and flags the following publicly disclosed vulnerabilities:

• CVE-2026-12087
• CVE-2026-48959
• CVE-2026-48961
• CVE-2026-48962

The current Graph Node Dockerfile also appears to use a dated Debian Bookworm
runtime base:

https://github.com/graphprotocol/graph-node/blob/master/docker/Dockerfile

Request

Would the maintainers consider one of the following?

1. Refresh the pinned Debian Bookworm runtime base.
2. Upgrade the affected Perl packages when fixed Bookworm packages become
   available.
3. Remove Perl from the final runtime image if it is not required by Graph Node.
4. Publish a rebuilt image after the relevant Debian updates become available.

Reproduction

The installed packages can be inspected with:

docker run --rm --entrypoint sh graphprotocol/graph-node:v0.41.0 -c \
  'cat /etc/os-release; dpkg-query -W perl-base perl libsocket-perl libio-compress-perl 2>/dev/null || true'

Upstream status

Debian is already tracking these issues:

https://security-tracker.debian.org/tracker/CVE-2026-12087
https://security-tracker.debian.org/tracker/CVE-2026-48959
https://security-tracker.debian.org/tracker/CVE-2026-48961
https://security-tracker.debian.org/tracker/CVE-2026-48962
The underlying fixes are already available upstream:

Socket fix:
https://github.com/Perl/perl5/commit/de19a0b0ad1900fef976c5c1400bd8f11ec6c6cb
IO::Compress fixes:
https://github.com/pmqs/IO-Compress/commit/68db44076f4c1a86a2ffe53a958eac6cabaf72e2
https://github.com/pmqs/IO-Compress/commit/33c89d03d6e746ed2ead4f2f6570d47864c61bc7
https://github.com/pmqs/IO-Compress/commit/f2db247bf90d4cc7ee2710be384946081f3b4610
Thank you for maintaining the Graph Node container images.