The active trivy-image configuration reports six OS package findings: #4163, #4164, #4169, #4170, #4171, #4172. Two are high severity, four medium. Dockerfile inherits appwrite/base:2.2.1; there is no APK upgrade in the production stage.

• libx11: installed 1.8.13-r0; scanner reports fixed 1.8.14-r0.
• libexpat: installed 2.8.5-r0; scanner reports fixed 2.9.0-r0. The integer-overflow alert is specifically 32-bit, so confirm architecture applicability rather than dismissing the whole library group.

Rebuild/update the base image with patched packages and consume the versioned base here. Verify the resulting production image, PHP/image-processing behavior, and a clean Trivy report. Treat current runtime libraries as actionable until verified; the 442 historical nightly image alerts are tracked separately in #14675.

Triage snapshot: ac7f088. Fresh merged-main scan: https://github.com/appwrite/appwrite/actions/runs/39271510595. Parent: #14675.