From f113b4f4b4be524d3d1ca72cdcd4c822663d4ec0 Mon Sep 17 00:00:00 2001
From: Anthony Stirling <77850077+Frooodle@users.noreply.github.com>
Date: Tue, 23 Jun 2026 20:16:23 +0100
Subject: [PATCH] Pin release docker base image to 1.0.2 to remove ffmpeg
 binary

---
 .github/workflows/push-docker.yml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/push-docker.yml b/.github/workflows/push-docker.yml
index ad7653eab3..5d192dcde6 100644
--- a/.github/workflows/push-docker.yml
+++ b/.github/workflows/push-docker.yml
@@ -155,9 +155,10 @@ jobs:
           cache-to: type=gha,mode=max,scope=stirling-pdf-latest
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
+          # Overrides the Dockerfile ARG default; 1.0.2 base drops the ffmpeg binary (CVEs).
           build-args: |
             VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }}
-            BASE_VERSION=1.0.0
+            BASE_VERSION=1.0.2
           platforms: linux/amd64,linux/arm64/v8
           provenance: true
           sbom: true