fix(ci): extend no-cache-filters to caddy-builder and crowdsec-builder in e2e workflow

Prevents stale GHA BuildKit layer cache from serving outdated caddy-builder
and crowdsec-builder stage outputs in e2e-tests-split.yml, mirroring the
same fix already applied to nightly-build.yml for CVE-2026-45135.

Also corrects a stale fallback version comment in Dockerfile (v2.11.3 → v2.11.4)
and updates SECURITY.md to mark CVE-2026-45135 as fully remediated across all
affected build workflows.

Author: actions-user

.github/workflows/e2e-tests-split.yml

@@ -184,6 +184,7 @@ jobs:
           tags: ${{ steps.resolve-image.outputs.image_tag }}
           cache-from: type=gha
           cache-to: type=gha,mode=max
+          no-cache-filters: caddy-builder,crowdsec-builder
 
       - name: Save Docker image
         if: steps.resolve-image.outputs.image_source == 'build'

Dockerfile

@@ -37,7 +37,7 @@ ARG NPM_VERSION=11.16.0
 # avoid accidentally pulling a v3 major release. Renovate can still update
 # this ARG to a specific v2.x tag when desired.
 ## Try to build the requested Caddy v2.x tag (Renovate can update this ARG).
-## If the requested tag isn't available, fall back to a known-good v2.11.3 build.
+## If the requested tag isn't available, fall back to a known-good v2.11.4 build.
 # renovate: datasource=go depName=github.com/caddyserver/caddy/v2
 ARG CADDY_VERSION=2.11.4
 # renovate: datasource=go depName=github.com/caddyserver/caddy/v2

SECURITY.md

@@ -241,13 +241,13 @@ Charon users is negligible since the vulnerable code path is not exercised.
 
 ---
 
-### [HIGH] CVE-2026-45135 · Caddy FastCGI Unsafe Unicode Handling in splitPos
+### ✅ [HIGH] CVE-2026-45135 · Caddy FastCGI Unsafe Unicode Handling in splitPos
 
 | Field        | Value |
 |--------------|-------|
 | **ID**       | CVE-2026-45135 |
 | **Severity** | High · 8.1 |
-| **Status**   | Fix deployed — `no-cache-filter: caddy-builder` added to nightly workflow |
+| **Status**   | Fully remediated — `no-cache-filters: caddy-builder,crowdsec-builder` applied to nightly and E2E build workflows |
 
 **What**
 Caddy v2.11.2 contains unsafe Unicode handling in the FastCGI `splitPos` function. A
@@ -280,10 +280,11 @@ prior nightly run despite the ARG value change — a known edge case where GHA c
 loses ARG-scoped metadata, preventing proper cache key invalidation.
 
 **Remediation Applied**
-Added `no-cache-filter: caddy-builder` to the `build-and-push-nightly` job in
-`.github/workflows/nightly-build.yml`. This forces the `caddy-builder` stage to rebuild from
-scratch on every nightly run, bypassing the GHA layer cache for that stage. All other stages
-continue to benefit from the cache.
+Added `no-cache-filters: caddy-builder,crowdsec-builder` to the `build-and-push-nightly` job in
+`.github/workflows/nightly-build.yml` and to the `Build Docker image` step in
+`.github/workflows/e2e-tests-split.yml`. This forces both the `caddy-builder` and
+`crowdsec-builder` stages to rebuild from scratch on every nightly and E2E build run, bypassing
+the GHA layer cache for those stages. All other stages continue to benefit from the cache.
 
 ---
 

docs/plans/current_spec.md

@@ -1,8 +1,14 @@
-# Fix: Flash of Unstyled Content (FOUC) / Forced Layout Warning
+---
+goal: Fix CVE-2026-45135 — Ensure CI detects Caddy v2.11.4 not stale v2.11.2 in all build workflows
+version: 1.0
+date_created: 2026-06-08
+status: 'Planned'
+tags: [fix, security, infrastructure]
+---
+
+# Fix CVE-2026-45135: Caddy FastCGI Unsafe Unicode Handling
 
-**Status:** Draft
-**Date:** 2026-06-05
-**Target Files:** `frontend/index.html`, `frontend/src/context/ThemeContext.tsx`, `frontend/src/i18n.ts`, `frontend/src/main.tsx`, `frontend/src/index.css`
+![Status: Planned](https://img.shields.io/badge/status-Planned-blue)
 
 ---