From 50db8d748447781acf2924ac22853a549ff2df6b Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Mon, 7 Sep 2026 23:33:49 +0000
Subject: [PATCH] fix: refresh vulnerable Debian codec package

Co-authored-by: jxxghp <51039935+jxxghp@users.noreply.github.com>
---
 docker/Dockerfile                  | 2 ++
 tests/test_release_supply_chain.py | 4 ++++
 2 files changed, 6 insertions(+)

diff --git a/docker/Dockerfile b/docker/Dockerfile
index 37a82f6f1..3c619621e 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -304,6 +304,8 @@ COPY --from=uv /uv /usr/local/bin/uv
 
 # 浏览器运行依赖
 RUN playwright install-deps chromium \
+    && apt-get update \
+    && apt-get install -y --no-install-recommends libde265-0 \
     && apt-get autoremove -y \
     && apt-get clean \
     && rm -rf \
diff --git a/tests/test_release_supply_chain.py b/tests/test_release_supply_chain.py
index 9cf347f09..1d19a7edc 100644
--- a/tests/test_release_supply_chain.py
+++ b/tests/test_release_supply_chain.py
@@ -126,6 +126,10 @@ def test_base_image_uses_refreshable_tag_and_apt_does_not_upgrade_in_place() ->
     assert "ARG MOVIEPILOT_PYTHON_VERSION" in free_threaded_stage
     assert 'uv python install --no-bin "${MOVIEPILOT_PYTHON_VERSION}t"' in free_threaded_stage
     assert "apt-get upgrade" not in dockerfile
+    assert (
+        "apt-get install -y --no-install-recommends libde265-0"
+        in dockerfile
+    )
     assert "\n    openssl \\\n" in dockerfile
     assert "\n    util-linux \\\n" in dockerfile