[BUG] Refresh the self-contained Prowlarr payload to .NET 8.0.29 or newer

[Feberdin]

Is there an existing issue for this?

• I have searched the existing issues

Current Behavior

The self-contained Prowlarr payload in the public image lscr.io/linuxserver/prowlarr:latest at digest sha256:1295cff29d10b486c0d8324d1559a552140a5932bf8b3d87e398654414f63f92 includes Microsoft.NETCore.App.Runtime.linux-musl-x64 8.0.27.

.NET 8.0.29 or newer contains fixes for CVE-2026-47302, CVE-2026-50524, CVE-2026-50528, CVE-2026-50651, and CVE-2026-57108.

The image label is 2.5.2.5491-ls156 and its creation timestamp is 2026-08-05T06:14:51.668160191Z. This is a bundled runtime maintenance report; no Prowlarr application-level exploitability is claimed.

Expected Behavior

The current public image should include a self-contained Prowlarr payload built with .NET 8.0.29 or a newer supported patch release.

Steps To Reproduce

1. Inspect the immutable public image digest listed above for the x86-64 platform.
2. Scan it with Trivy 0.73.0.
3. Observe Microsoft.NETCore.App.Runtime.linux-musl-x64 8.0.27.
4. Compare it with the fixed .NET 8.0.29 patch line.

The Dockerfile downloads the self-contained Prowlarr release archive, so the runtime is part of that payload rather than a separately installed Alpine package.

Environment

• OS: Public image artifact; detected base is Alpine 3.24.1
• How docker service was installed: Not applicable; reproduction operates on the public registry artifact and does not require a running container

CPU architecture

x86-64

Docker creation

Not applicable; no container needs to be created to reproduce the embedded runtime version.

Container logs

Not applicable; the finding is present in the immutable image layers before container startup.

Suggested remediation

1. Coordinate or consume a Prowlarr release built with .NET 8.0.29 or newer.
2. Rebuild the image with that release archive.
3. Publish an immutable digest and verify that .NET 8.0.27 is absent.

[github-actions]

Thanks for opening your first issue here! Be sure to follow the relevant issue templates, or risk having this issue marked as invalid.

[aptalca]

Please ask whichever AI generated this who packaged up the net core and report to them. Because it's not us. And please don't open multiple issues in multiple repos at once for essentially the same issue.

https://www.linuxserver.io/blog/image-vulnerability-scanning-and-you

[Feberdin]

You are right. I should have verified component ownership and practical applicability, and I should have read the LinuxServer.io reporting guidance before opening multiple scanner-driven issues. That was my mistake. Sorry for the noise and the unnecessary triage work. I will not refile these findings here.