Merge pull request #1616 from snyk/fix/update-ubi-base-image

fix: upgrade UBI9 to 9.7

Author: pecodez

.snyk

@@ -1,35 +1,27 @@
 # Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.
-version: v1.25.0
+version: v1.25.1
 # ignores vulnerabilities until expiry date; change duration by modifying expiry date
 ignore:
-    SNYK-JS-BRACES-6838727:
+  SNYK-JS-BRACES-6838727:
     - '*':
         reason: devDependency
         expires: 2025-12-01T12:00:00.000Z
         created: 2024-10-23T12:00:00.000Z
-    SNYK-RHEL9-EXPAT-12672450:
+  SNYK-RHEL9-EXPAT-12672450:
     - '*':
-        reason: >-
-          There is no fix at this time
+        reason: There is no fix at this time
         expires: 2026-10-31T12:00:00.000Z
         created: 2025-09-15T12:00:00.000Z
-    SNYK-JS-TOUGHCOOKIE-5672873:
+  SNYK-JS-TOUGHCOOKIE-5672873:
     - '*':
         reason: >-
           Waiting for @kubernetes/client-node fetch migration
           https://github.com/kubernetes-client/javascript/blob/master/FETCH_MIGRATION.md
         expires: 2025-01-10T12:00:00.000Z
         created: 2024-10-23T12:00:00.000Z
-    SNYK-RHEL9-LIBXML2-13863026:
-    - '*':
-        reason: >-
-          No fix available at this time
-        expires: 2025-12-19T12:00:00.000Z
-        created: 2025-11-19T12:00:00.000Z
-    SNYK-PYTHON-SETUPTOOLS-7448482:
+  SNYK-RHEL9-LIBXML2-13863026:
     - '*':
-        reason: >-
-          Introduced by Google Cloud SDK, waiting for upstream fix
-        expires: 2025-12-19T12:00:00.000Z
-        created: 2025-11-19T12:00:00.000Z
+        reason: No upstream fix available
+        expires: 2026-01-19T00:00:00.000Z
+        created: 2025-11-19T08:49:30.715Z
 patch: {}

Dockerfile.ubi9

@@ -1,7 +1,9 @@
+ARG UBI9_VERSION=9.7
+
 #---------------------------------------------------------------------
 # STAGE 1: Build credential helpers inside a temporary container
 #---------------------------------------------------------------------
-FROM --platform=linux/amd64 registry.access.redhat.com/ubi9/go-toolset:9.6 as cred-helpers-build
+FROM --platform=linux/amd64 registry.access.redhat.com/ubi9/go-toolset:${UBI9_VERSION} as cred-helpers-build
 
 RUN GOTOOLCHAIN=go1.23.4 go install github.com/awslabs/amazon-ecr-credential-helper/ecr-login/cli/docker-credential-ecr-login@bef5bd9384b752e5c645659165746d5af23a098a
 RUN --mount=type=secret,id=gh_token,uid=1001,required=true \
@@ -13,7 +15,7 @@ RUN --mount=type=secret,id=gh_token,uid=1001,required=true \
 #---------------------------------------------------------------------
 # STAGE 2: Build kubernetes-monitor application
 #---------------------------------------------------------------------
-FROM --platform=linux/amd64 registry.access.redhat.com/ubi9/nodejs-22:9.6 AS build
+FROM --platform=linux/amd64 registry.access.redhat.com/ubi9/nodejs-22:${UBI9_VERSION} AS build
 
 ENV NODE_ENV production
 
@@ -31,14 +33,14 @@ RUN npm run build
 #---------------------------------------------------------------------
 # STAGE 3: Install containers-common to obtain configuration files
 #---------------------------------------------------------------------
-FROM --platform=linux/amd64 registry.access.redhat.com/ubi9/ubi:9.6 AS containers-common
+FROM --platform=linux/amd64 registry.access.redhat.com/ubi9/ubi:${UBI9_VERSION} AS containers-common
 
 RUN dnf install -y containers-common
 
 #---------------------------------------------------------------------
 # STAGE 4: Build the kubernetes-monitor final image
 #---------------------------------------------------------------------
-FROM --platform=linux/amd64 registry.access.redhat.com/ubi9/ubi:9.6
+FROM --platform=linux/amd64 registry.access.redhat.com/ubi9/ubi:${UBI9_VERSION}
 
 ARG NODE_MAJOR_VERSION=22
 ARG NODE_LATEST_VERSION