🐳 Remove OpenEXR support from ImageMagick and Docker images

Penpot only accepts jpeg, png, webp, gif and svg images, so the
EXR coder was never used. It was enabled only because ImageMagick's
configure auto-detected libopenexr-dev at build time.

OpenEXR accounted for 25 CVEs (15 High) in both the exporter and
media-processor images, and was also bundled into the backend via
/opt/imagick/lib/deps, where dpkg-based scanners cannot see it.

- Build ImageMagick with --without-openexr and drop libopenexr-dev
- Drop libopenexr-3-1-30 from the imagemagick, backend, exporter,
  media-processor and devenv images
- Remove `apt-get upgrade` from the ImageMagick build stage
- Bump penpotapp/imagemagick to 7.1.2-27-1

Signed-off-by: David Barragán Merino <david.barragan@kaleidos.net>

docker/devenv/Dockerfile

@@ -526,7 +526,6 @@ RUN set -ex; \
       libjpeg62-turbo \
       libtiff6 \
       libwebp7 \
-      libopenexr-3-1-30 \
       libfreetype6 \
       libfontconfig1 \
       libglib2.0-0 \
@@ -576,7 +575,7 @@ ENV LANG='C.UTF-8' \
     SERENA_CONTEXT="claude-code" \
     PATH="/opt/jdk/bin:/opt/gh/bin:/opt/utils/bin:/opt/clojure/bin:/opt/node/bin:/opt/imagick/bin:/opt/cargo/bin:$PATH"
 
-COPY --from=penpotapp/imagemagick:7.1.2-27 /opt/imagick /opt/imagick
+COPY --from=penpotapp/imagemagick:7.1.2-27-1 /opt/imagick /opt/imagick
 COPY --from=setup-jvm /opt/jdk /opt/jdk
 COPY --from=setup-jvm /opt/clojure /opt/clojure
 COPY --from=setup-node /opt/node /opt/node

docker/imagemagick/Dockerfile

@@ -10,7 +10,6 @@ ARG IMAGEMAGICK_VERSION=7.1.2-27
 
 RUN set -e; \
     apt-get -qq update; \
-    apt-get -qq upgrade; \
     apt-get -qqy --no-install-recommends install init-system-helpers; \
     apt-get -qqy --no-install-recommends install \
         autoconf \
@@ -24,7 +23,6 @@ RUN set -e; \
         liblcms2-dev \
         libltdl-dev \
         liblzma-dev \
-        libopenexr-dev \
         libxml2-dev \
         libpng-dev \
         librsvg2-dev \
@@ -39,7 +37,7 @@ RUN set -e; \
     mkdir -p /tmp/magick; \
     cd /tmp/magick; \
     tar -xf /tmp/magick.tar.gz --strip-components=1; \
-    ./configure --prefix=/opt/imagick; \
+    ./configure --prefix=/opt/imagick --without-openexr; \
     make -j 2; \
     make install; \
     rm -rf /opt/imagick/lib/libMagick++*; \
@@ -58,7 +56,6 @@ RUN set -ex; \
         libheif1 \
         libjpeg62-turbo \
         liblcms2-2 \
-        libopenexr-3-1-30 \
         libopenjp2-7 \
         libpng16-16 \
         librsvg2-2 \

docker/images/Dockerfile.backend

@@ -80,7 +80,6 @@ RUN set -ex; \
         libheif1 \
         libjpeg62-turbo \
         liblcms2-2 \
-        libopenexr-3-1-30 \
         libopenjp2-7 \
         libpng16-16 \
         librsvg2-2 \
@@ -107,7 +106,7 @@ RUN set -ex; \
     chown -R penpot:penpot /opt/data;
 
 COPY --from=build /opt/jre /opt/jre
-COPY --from=penpotapp/imagemagick:7.1.2-27 /opt/imagick /opt/imagick
+COPY --from=penpotapp/imagemagick:7.1.2-27-1 /opt/imagick /opt/imagick
 
 COPY files/imagemagick-policy.xml /opt/imagick/etc/ImageMagick-7/policy.xml
 

docker/images/Dockerfile.exporter

@@ -70,7 +70,6 @@ RUN set -ex; \
       libheif1 \
       libjpeg62-turbo \
       liblcms2-2 \
-      libopenexr-3-1-30 \
       libopenjp2-7 \
       libpng16-16 \
       librsvg2-2 \
@@ -89,7 +88,7 @@ RUN set -ex; \
 
 ARG BUNDLE_PATH="./bundle-exporter/"
 COPY --chown=penpot:penpot $BUNDLE_PATH /opt/penpot/exporter/
-COPY --from=penpotapp/imagemagick:7.1.2-27 /opt/imagick /opt/imagick
+COPY --from=penpotapp/imagemagick:7.1.2-27-1 /opt/imagick /opt/imagick
 
 WORKDIR /opt/penpot/exporter
 

docker/images/Dockerfile.media-processor

@@ -34,7 +34,6 @@ RUN set -ex; \
       libheif1 \
       libjpeg62-turbo \
       liblcms2-2 \
-      libopenexr-3-1-30 \
       libopenjp2-7 \
       libpng16-16 \
       librsvg2-2 \