Refresh MCP and BLAST runtime images to patched Debian 13

blast-jobs/Dockerfile

@@ -9,10 +9,10 @@ RUN cargo build --release --locked --bin blast-jobs
 
 # Versioned path (never LATEST), pinned by SHA-256. NCBI publishes only an MD5 next to the tarball
 # (bdec166721de3b55f90a3badc83538e8); the SHA-256 below was computed from a download that matched it.
-FROM debian:bookworm-slim AS blast
+FROM debian:trixie-slim AS blast
 ARG BLAST_URL=https://ftp.ncbi.nlm.nih.gov/blast/executables/blast+/2.17.0/ncbi-blast-2.17.0+-x64-linux.tar.gz
 ARG BLAST_SHA256=3888112d8207831aa47371d93583c601f058f88b5db22dc782438b039a3a411b
-RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates curl && rm -rf /var/lib/apt/lists/*
+RUN apt-get update && apt-get upgrade -y && apt-get install -y --no-install-recommends ca-certificates curl && rm -rf /var/lib/apt/lists/*
 RUN curl -fsSL --retry 3 -o /tmp/blast.tar.gz "$BLAST_URL" \
  && echo "$BLAST_SHA256  /tmp/blast.tar.gz" | sha256sum -c - \
  && mkdir -p /opt/ncbi-blast/bin \
@@ -22,9 +22,9 @@ RUN curl -fsSL --retry 3 -o /tmp/blast.tar.gz "$BLAST_URL" \
  && cp /tmp/ncbi-blast-2.17.0+/LICENSE /opt/ncbi-blast/LICENSE \
  && rm -rf /tmp/blast.tar.gz /tmp/ncbi-blast-2.17.0+
 
-FROM debian:bookworm-slim
+FROM debian:trixie-slim
 # curl for the HEALTHCHECK; libgomp1 is the one shared library BLAST+ needs beyond the base image.
-RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates curl libgomp1 && rm -rf /var/lib/apt/lists/*
+RUN apt-get update && apt-get upgrade -y && apt-get install -y --no-install-recommends ca-certificates curl libgomp1 && rm -rf /var/lib/apt/lists/*
 COPY --from=blast /opt/ncbi-blast /opt/ncbi-blast
 ENV PATH=/opt/ncbi-blast/bin:$PATH NCBI_DONT_USE_NCBIRC=1 NCBI_DONT_USE_LOCAL_CONFIG=1 BLAST_USAGE_REPORT=false
 # A missing shared library or a wrong build fails here, not at the first job.

docs/deployment.md

@@ -192,3 +192,19 @@ connection URL is never logged with its password.
 
 `rmcp` logs one `ERROR` line, "failed to send pending response during drain", each time a client disconnects
 before its response is written. It is not a server fault; do not alert on it.
+
+### Runtime security refresh (October 2026)
+
+The MCP and BLAST job Dockerfiles use Debian 13 (`trixie-slim`) runtimes and
+apply available package upgrades during each build. The Rust builder, locked
+application dependencies, BLAST+ 2.17.0 checksum, service UIDs, and health checks
+remain unchanged. Build with `--pull`, scan the resulting images, and test the
+actual runtime against the database and BLAST fixtures before replacing services.
+No database migrations are needed for this runtime-only change.
+
+Retain previous images for rollback. Before replacing BLAST, check its internal
+health response for zero queued/running jobs; restarting loses in-memory job
+metadata even though the state directory remains mounted. Keep the same state,
+configuration, credentials, limits, and read-only database mounts. Validate MCP
+initialization/tool discovery, a real read-only tool call, wiki access, and an
+end-to-end BLAST search after deployment. Do not restart the main website.

mcp/Dockerfile

@@ -7,8 +7,8 @@ COPY sql ./sql
 COPY data ./data
 RUN cargo build --release --locked --bin flybase-mcp
 
-FROM debian:bookworm-slim
-RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates curl && rm -rf /var/lib/apt/lists/*
+FROM debian:trixie-slim
+RUN apt-get update && apt-get upgrade -y && apt-get install -y --no-install-recommends ca-certificates curl && rm -rf /var/lib/apt/lists/*
 RUN useradd --system --uid 10001 flybase
 COPY --from=build /src/target/release/flybase-mcp /usr/local/bin/flybase-mcp
 USER flybase