fix: patch Alpine packages in container images and bump handlebars

.projenrc.ts

@@ -724,6 +724,7 @@ function updatePackageJson() {
       "@babel/core": "^7.29.6",
       sharp: "^0.35.5",
       "source-map-js": "^1.2.2",
+      "handlebars@4": "^4.7.10",
     }),
   );
   packageJson?.patch(JsonPatch.add("/packageManager", `pnpm@${pnpmVersion}`));

README.md

@@ -89,6 +89,8 @@ For the Containers types, cdk-nextjs generates a Dockerfile in your Next.js app'
 
 Every generated Dockerfile starts with the line `# ~~ Generated by cdk-nextjs ~~`, and cdk-nextjs **overwrites** any file carrying it — that way an upgrade that changes how the image is built does not leave a stale Dockerfile behind. To customize it, delete that first line; cdk-nextjs then leaves the file alone. If you edited a generated file without deleting the header, cdk-nextjs saves your version beside it as `<name>.Dockerfile.bak` before replacing it; gitignore that too.
 
+The generated Dockerfile runs `apk upgrade` so the image picks up Alpine security fixes released after the `node:24-alpine` base image was published. If you own your Dockerfile, add `RUN apk upgrade --no-cache` after its `FROM` line. CDK only rebuilds the image when the app or Dockerfile changes, so a stack redeployed with an unchanged app keeps its existing image and its packages.
+
 ## Basic Example CDK App
 
 ```ts

src/nextjs-build/global-containers.Dockerfile

@@ -6,6 +6,10 @@
 
 # Production image, copy all the files and run next
 FROM public.ecr.aws/docker/library/node:24-alpine AS runner
+# The node image is republished only every few weeks, so it can ship Alpine
+# packages that already have security fixes. This picks them up whenever the
+# image is rebuilt, which CDK does only when the app or this file changes.
+RUN apk upgrade --no-cache
 # Check https://github.com/nodejs/docker-node/tree/b4117f9333da4138b03a546ec926ef50a31506c3#nodealpine to understand why libc6-compat might be needed.
 RUN apk add --no-cache libc6-compat
 WORKDIR /app

src/nextjs-build/regional-containers.Dockerfile

@@ -6,6 +6,10 @@
 
 # Production image, copy all the files and run next
 FROM public.ecr.aws/docker/library/node:24-alpine AS runner
+# The node image is republished only every few weeks, so it can ship Alpine
+# packages that already have security fixes. This picks them up whenever the
+# image is rebuilt, which CDK does only when the app or this file changes.
+RUN apk upgrade --no-cache
 # Check https://github.com/nodejs/docker-node/tree/b4117f9333da4138b03a546ec926ef50a31506c3#nodealpine to understand why libc6-compat might be needed.
 RUN apk add --no-cache libc6-compat
 WORKDIR /app