ipx-web without curl, which CVE-2026-92392 affects in caddy:2's 8.22.0 (#237)

Nothing in the image ran it: Caddy is Go, and there has been no healthcheck since #218.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Dockerfile.web

@@ -8,6 +8,9 @@ COPY web ./web
 RUN node web/build.mjs /dist
 
 FROM caddy:2
+# caddy:2's Alpine ships curl, which nothing here runs (no healthcheck since #218): out, so a
+# curl flaw such as CVE-2026-92392 has nothing to reach in a container facing the internet (#237).
+RUN apk del --no-cache curl
 COPY web/Caddyfile /etc/caddy/Caddyfile
 COPY --from=build /dist /srv
 EXPOSE 8080

web/CHANGELOG.md

@@ -11,6 +11,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Security
+
+- The ipx-web image no longer carries curl, which Caddy's base image shipped and nothing used: 8.22.0 there is affected by CVE-2026-92392 (#237).
+
 ### Fixed
 
 - The refresh buttons turn from the moment they are pressed until the scan they asked for has finished, smoothly, instead of jerking back upright between one feed and the next (#231, #233).