Clean docker build failed

[ostiwe]

Product

Platform/Access controls/Other

Describe the bug

On main branch, commands docker build -t ... -f Dockerfile.fips.standalone-infisical --no-cache --pull . and docker build -t ... -f Dockerfile.standalone-infisical --no-cache --pull . failed with error

...
296.7 dpkg is already the newest version (1.22.22).
296.7 libnghttp2-14 is already the newest version (1.64.0-1.1+deb13u1).
296.7 libngtcp2-16 is already the newest version (1.11.0-1+deb13u1).
296.7 libngtcp2-crypto-gnutls8 is already the newest version (1.11.0-1+deb13u1).
296.7 The following packages will be REMOVED:
296.7   libssl-dev
296.7 The following packages will be upgraded:
296.7   libcap2
296.7 The following packages will be DOWNGRADED:
296.7   libssl3t64
296.7 1 upgraded, 0 newly installed, 1 downgraded, 1 to remove and 8 not upgraded.
296.7 E: Packages were downgraded and -y was used without --allow-downgrades.

Possible, after these commit - 607477e

To Reproduce

1. Clone repository
2. Run docker build -t ... -f Dockerfile.standalone-infisical --no-cache --pull .

Expected behavior

Success build docker image by provided dockerfile

Screenshots

No response

Deployment Type

Self-hosted

Additional context

No response

[linear]

ENG-5320

[jaydeep-pipaliya]

Sent a fix — added --allow-downgrades to the CVE-pin layer in both Dockerfiles. The pinned versions were correct for their CVE-patch intent but the base image drifted higher on libssl3t64, so apt refuses without the flag. PR up.