fix: apply OS security updates to base images at build time

.changeset/patch-base-image-os-packages.md

@@ -0,0 +1,5 @@
+---
+'hive': patch
+---
+
+Apply OS security updates to the base image at build time by adding `apt-get upgrade` to the service, migrations, and CLI Dockerfiles. Previously these only ran `apt-get update` followed by `apt-get install` of a few specific packages, so Debian security patches inherited from the pinned `node:*-slim` base were never applied — leaving published images with known-fixed CVEs. Bumping the base image tag alone does not fix this, since the latest `node` tag can still lag behind Debian's security updates.

docker/cli.dockerfile

@@ -1,6 +1,6 @@
 FROM node:24.14.1-slim
 
-RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates git && rm -rf /var/lib/apt/lists/*
+RUN apt-get update && apt-get upgrade -y && apt-get install -y --no-install-recommends ca-certificates git && rm -rf /var/lib/apt/lists/*
 
 ARG CLI_VERSION
 

docker/migrations.dockerfile

@@ -1,6 +1,6 @@
 FROM node:24.14.1-slim
 
-RUN apt-get update && apt-get install -y ca-certificates
+RUN apt-get update && apt-get upgrade -y && apt-get install -y ca-certificates && rm -rf /var/lib/apt/lists/*
 
 WORKDIR /usr/src/app
 

docker/services.dockerfile

@@ -1,6 +1,6 @@
 FROM node:24.14.1-slim
 
-RUN apt-get update && apt-get install -y wget ca-certificates && rm -rf /var/lib/apt/lists/*
+RUN apt-get update && apt-get upgrade -y && apt-get install -y wget ca-certificates && rm -rf /var/lib/apt/lists/*
 
 ARG SERVICE_DIR_NAME
 WORKDIR /usr/src/app/$SERVICE_DIR_NAME