feat(docker): update Chromium to 140.0.7339.185 (#791)

Author: Proximyst

CHANGELOG.md

@@ -1,9 +1,13 @@
+## 4.0.15 (2025-09-23)
+
+- Docker: Update Chromium to 140.0.7339.185 (CVE-2025-10500, CVE-2025-10501, CVE-2025-10502, CVE-2025-10585), [#791](https://github.com/grafana/grafana-image-renderer/pull/791), [Proximyst](https://github.com/Proximyst)
+
 ## 4.0.14 (2025-09-11)
 
 The Grafana Image Renderer plugin has been deprecated.
 If you use the plugin, please migrate to the remote server; the plugin will eventually stop receiving updates.
 
-- Docker: Update Chromium to 140.0.7339.127 (CVE-2025-10200, CVE-2025-102201), [#x](https://github.com/grafana/grafana-image-renderer/pull/x), [Proximyst](https://github.com/Proximyst)
+- Docker: Update Chromium to 140.0.7339.127 (CVE-2025-10200, CVE-2025-102201), [#772](https://github.com/grafana/grafana-image-renderer/pull/772), [Proximyst](https://github.com/Proximyst)
 
 ## 4.0.13 (2025-09-08)
 

Dockerfile

@@ -5,11 +5,11 @@ SHELL ["/bin/bash", "-euo", "pipefail", "-c"]
 # If we ever need to bust the cache, just change the date here.
 # While we don't cache anything in Drone, that might not be true when we migrate to GitHub Actions where some action might automatically enable layer caching.
 # This is fine, but is terrible in situations where we want to _force_ an update of a package.
-RUN echo 'cachebuster 2025-09-11' && apt-get update
+RUN echo 'cachebuster 2025-09-23' && apt-get update
 
 FROM debian-updated AS debs
 
-ARG CHROMIUM_VERSION=140.0.7339.127
+ARG CHROMIUM_VERSION=140.0.7339.185
 RUN apt-cache depends chromium=${CHROMIUM_VERSION} chromium-driver chromium-shell chromium-sandbox font-gothic fonts-wqy-zenhei fonts-thai-tlwg fonts-khmeros fonts-kacst fonts-freefont-ttf libxss1 unifont fonts-open-sans fonts-roboto fonts-inter bash util-linux openssl tini ca-certificates locales libnss3-tools \
     --recurse --no-recommends --no-suggests --no-conflicts --no-breaks --no-replaces --no-enhances --no-pre-depends | grep '^\w' | xargs apt-get download
 RUN mkdir /dpkg && \

go.Dockerfile

@@ -23,9 +23,9 @@ SHELL ["/bin/bash", "-euo", "pipefail", "-c"]
 # If we ever need to bust the cache, just change the date here.
 # While we don't cache anything in Drone, that might not be true when we migrate to GitHub Actions where some action might automatically enable layer caching.
 # This is fine, but is terrible in situations where we want to _force_ an update of a package.
-RUN echo 'cachebuster 2025-09-11' && apt-get update
+RUN echo 'cachebuster 2025-09-23' && apt-get update
 
-ARG CHROMIUM_VERSION=140.0.7339.127
+ARG CHROMIUM_VERSION=140.0.7339.185
 RUN apt-cache depends chromium=${CHROMIUM_VERSION} chromium-driver chromium-shell chromium-sandbox font-gothic fonts-wqy-zenhei fonts-thai-tlwg fonts-khmeros fonts-kacst fonts-freefont-ttf libxss1 unifont fonts-open-sans fonts-roboto fonts-inter bash busybox util-linux openssl tini ca-certificates locales libnss3-tools \
     --recurse --no-recommends --no-suggests --no-conflicts --no-breaks --no-replaces --no-enhances --no-pre-depends | grep '^\w' | xargs apt-get download
 RUN mkdir /dpkg && \

plugin.json

@@ -24,8 +24,8 @@
         "url": "https://github.com/grafana/grafana-image-renderer/blob/master/LICENSE"
       }
     ],
-    "version": "4.0.14",
-    "updated": "2025-09-11"
+    "version": "4.0.15",
+    "updated": "2025-09-23"
   },
   "dependencies": {
     "grafanaDependency": ">=11.3.8"