From 0049c8b6737f24d771c1f2a4dd7a7dee5ea17817 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?David=20Barrag=C3=A1n=20Merino?=
 <david.barragan@kaleidos.net>
Date: Tue, 29 Sep 2026 17:01:15 +0200
Subject: [PATCH] :whale: Remove OpenEXR support from ImageMagick and Docker
 images
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Penpot only accepts jpeg, png, webp, gif and svg images, so the
EXR coder was never used. It was enabled only because ImageMagick's
configure auto-detected libopenexr-dev at build time.

OpenEXR accounted for 25 CVEs (15 High) in both the exporter and
media-processor images, and was also bundled into the backend via
/opt/imagick/lib/deps, where dpkg-based scanners cannot see it.

- Build ImageMagick with --without-openexr and drop libopenexr-dev
- Drop libopenexr-3-1-30 from the imagemagick, backend, exporter,
  media-processor and devenv images
- Remove `apt-get upgrade` from the ImageMagick build stage
- Bump penpotapp/imagemagick to 7.1.2-27-1

Signed-off-by: David Barragán Merino <david.barragan@kaleidos.net>
---
 docker/devenv/Dockerfile                 | 3 +--
 docker/imagemagick/Dockerfile            | 5 +----
 docker/images/Dockerfile.backend         | 3 +--
 docker/images/Dockerfile.exporter        | 3 +--
 docker/images/Dockerfile.media-processor | 1 -
 5 files changed, 4 insertions(+), 11 deletions(-)

diff --git a/docker/devenv/Dockerfile b/docker/devenv/Dockerfile
index 2676463b59..bef47f76ae 100644
--- a/docker/devenv/Dockerfile
+++ b/docker/devenv/Dockerfile
@@ -526,7 +526,6 @@ RUN set -ex; \
       libjpeg62-turbo \
       libtiff6 \
       libwebp7 \
-      libopenexr-3-1-30 \
       libfreetype6 \
       libfontconfig1 \
       libglib2.0-0 \
@@ -576,7 +575,7 @@ ENV LANG='C.UTF-8' \
     SERENA_CONTEXT="claude-code" \
     PATH="/opt/jdk/bin:/opt/gh/bin:/opt/utils/bin:/opt/clojure/bin:/opt/node/bin:/opt/imagick/bin:/opt/cargo/bin:$PATH"
 
-COPY --from=penpotapp/imagemagick:7.1.2-27 /opt/imagick /opt/imagick
+COPY --from=penpotapp/imagemagick:7.1.2-27-1 /opt/imagick /opt/imagick
 COPY --from=setup-jvm /opt/jdk /opt/jdk
 COPY --from=setup-jvm /opt/clojure /opt/clojure
 COPY --from=setup-node /opt/node /opt/node
diff --git a/docker/imagemagick/Dockerfile b/docker/imagemagick/Dockerfile
index 92ff766acb..0ab72b37af 100644
--- a/docker/imagemagick/Dockerfile
+++ b/docker/imagemagick/Dockerfile
@@ -10,7 +10,6 @@ ARG IMAGEMAGICK_VERSION=7.1.2-27
 
 RUN set -e; \
     apt-get -qq update; \
-    apt-get -qq upgrade; \
     apt-get -qqy --no-install-recommends install init-system-helpers; \
     apt-get -qqy --no-install-recommends install \
         autoconf \
@@ -24,7 +23,6 @@ RUN set -e; \
         liblcms2-dev \
         libltdl-dev \
         liblzma-dev \
-        libopenexr-dev \
         libxml2-dev \
         libpng-dev \
         librsvg2-dev \
@@ -39,7 +37,7 @@ RUN set -e; \
     mkdir -p /tmp/magick; \
     cd /tmp/magick; \
     tar -xf /tmp/magick.tar.gz --strip-components=1; \
-    ./configure --prefix=/opt/imagick; \
+    ./configure --prefix=/opt/imagick --without-openexr; \
     make -j 2; \
     make install; \
     rm -rf /opt/imagick/lib/libMagick++*; \
@@ -58,7 +56,6 @@ RUN set -ex; \
         libheif1 \
         libjpeg62-turbo \
         liblcms2-2 \
-        libopenexr-3-1-30 \
         libopenjp2-7 \
         libpng16-16 \
         librsvg2-2 \
diff --git a/docker/images/Dockerfile.backend b/docker/images/Dockerfile.backend
index b2af5941c3..e2f1f15179 100644
--- a/docker/images/Dockerfile.backend
+++ b/docker/images/Dockerfile.backend
@@ -80,7 +80,6 @@ RUN set -ex; \
         libheif1 \
         libjpeg62-turbo \
         liblcms2-2 \
-        libopenexr-3-1-30 \
         libopenjp2-7 \
         libpng16-16 \
         librsvg2-2 \
@@ -107,7 +106,7 @@ RUN set -ex; \
     chown -R penpot:penpot /opt/data;
 
 COPY --from=build /opt/jre /opt/jre
-COPY --from=penpotapp/imagemagick:7.1.2-27 /opt/imagick /opt/imagick
+COPY --from=penpotapp/imagemagick:7.1.2-27-1 /opt/imagick /opt/imagick
 
 COPY files/imagemagick-policy.xml /opt/imagick/etc/ImageMagick-7/policy.xml
 
diff --git a/docker/images/Dockerfile.exporter b/docker/images/Dockerfile.exporter
index 0b8fbf0da7..1153014be3 100644
--- a/docker/images/Dockerfile.exporter
+++ b/docker/images/Dockerfile.exporter
@@ -70,7 +70,6 @@ RUN set -ex; \
       libheif1 \
       libjpeg62-turbo \
       liblcms2-2 \
-      libopenexr-3-1-30 \
       libopenjp2-7 \
       libpng16-16 \
       librsvg2-2 \
@@ -89,7 +88,7 @@ RUN set -ex; \
 
 ARG BUNDLE_PATH="./bundle-exporter/"
 COPY --chown=penpot:penpot $BUNDLE_PATH /opt/penpot/exporter/
-COPY --from=penpotapp/imagemagick:7.1.2-27 /opt/imagick /opt/imagick
+COPY --from=penpotapp/imagemagick:7.1.2-27-1 /opt/imagick /opt/imagick
 
 WORKDIR /opt/penpot/exporter
 
diff --git a/docker/images/Dockerfile.media-processor b/docker/images/Dockerfile.media-processor
index 3a2975c578..fbabbfb70f 100644
--- a/docker/images/Dockerfile.media-processor
+++ b/docker/images/Dockerfile.media-processor
@@ -34,7 +34,6 @@ RUN set -ex; \
       libheif1 \
       libjpeg62-turbo \
       liblcms2-2 \
-      libopenexr-3-1-30 \
       libopenjp2-7 \
       libpng16-16 \
       librsvg2-2 \