Docker image keygraph/shannon:3.3.0 has 462 critical / 1179 high CVEs (mostly Chromium 149.0.7827.53)

Docker Scout scan of keygraph/shannon:3.3.0 (same digest as :latest, image ID 548a65360536, base cgr.dev/chainguard/wolfi-base:latest) reports:

CRITICAL 462 | HIGH 1179 | MEDIUM 1930 | LOW 184

Critical: all from chromium 149.0.7827.53-r0 (154 CVEs, listed once per package path). The Wolfi base is already latest, so docker scout recommendations returns nothing; the image needs a rebuild to pick up a newer Chromium.

High, with fixes available (Dockerfile steps apk add ... nodejs-22 npm python3 chromium ... and the /app setup step):

• npm-12 12.0.2-r3 (fixed in 12.2.0-r1 / 12.1.0-r2; bundled brace-expansion 5.0.9 -> 5.0.11)
• browserslist 4.28.1 -> 4.28.7
• hono 4.12.14 -> 4.13.7
• ip-address 10.1.0 -> 10.7.1
• smol-toml 1.6.1 -> 1.7.1
• python-3.13 3.13.15_git20260918-r1 -> 3.13.16_git20261002-r0
• http-cache-semantics 4.2.0 (HIGH, no fix released yet)

Could the release image be rebuilt on updated packages, and a Scout/Trivy check added to the release pipeline? Happy to provide the full docker scout cves output.

Found while setting up Shannon for a pre-handover pentest; not a vulnerability in Shannon's own code.