Platform images (cron/server/worker/launcher) ship on End-of-Life Amazon Linux 2 (SUPPORT_END 2026-06-30)

### Helm Chart Version

2.1.0

### What step the error happened?

Other

### Relevant information

### Summary
All Airbyte **platform** images are built on **Amazon Linux 2**, which reaches end-of-life on **2026-06-30** (per the image's own `/etc/os-release`). After that date AWS stops publishing ALAS security patches, so the OS-level CVEs already present in these images become **permanently unpatchable**.

This is flagged as a critical/high finding by image scanners (Wiz, Trivy). It is not fixable by upgrading: the **latest `master` build is still on Amazon Linux 2** (see "Relevant log output").

Note: `airbytehq/airbyte-platform` has GitHub Issues disabled, so filing here per project convention.

### Affected images (app version `2.1.0`)
- `airbyte/cron`
- `airbyte/server`
- `airbyte/worker`
- `airbyte/workload-launcher`
- `airbyte/workload-api-server`

All share `PRETTY_NAME="Amazon Linux 2"` / `SUPPORT_END="2026-06-30"` (confirmed for cron, server, worker, workload-launcher).

### Vulnerability evidence — `airbyte/cron:2.1.0` (Trivy)

| Source | CRITICAL | HIGH | MEDIUM | LOW |
|---|---|---|---|---|
| OS packages (Amazon Linux 2) | 0 | 62 | 46 | 5 |
| Bundled JARs (application) | 2 | 16 | 15 | 2 |

**CRITICAL (bundled Java agents):**
- `CVE-2026-33728` — `com.datadoghq:dd-java-agent` 1.51.1 → fixed in **1.60.3**
- `CVE-2026-33701` — `io.opentelemetry.javaagent:opentelemetry-javaagent` 2.17.1 → fixed in **2.26.1**

**Representative OS HIGHs (have AL2 patches the image wasn't rebuilt against — unpatchable after EOL):**
- `openssl-libs` 1.0.2k — 12 CVEs (CVE-2026-28388/28389/28390, CVE-2026-34180, CVE-2026-42766, …)
- `python` / `python-libs` 2.7.18 — 11 CVEs (Python 2 is itself EOL and present in the image)
- `glibc` 2.26 (CVE-2026-4046), `libxml2` 2.9.1 (CVE-2025-49794/49796), `libpng` 1.5.13, `libnghttp2`, `vim-minimal`

**Notable application-dependency HIGHs:**
- `io.netty:*` 4.2.9.Final — multiple (codec-http/http2, handler, resolver-dns)
- `org.postgresql:postgresql` 42.7.8 → 42.7.11 (CVE-2026-42198)
- `io.micronaut:micronaut-context` 4.10.18 → 4.10.22

### Impact
64+ HIGH/CRITICAL findings per platform image become **frozen and unpatchable** once AL2 hits EOL on 2026-06-30. Every Airbyte deployment inherits this and cannot remediate without upstream action.

### Requested remediation
1. **Rebase platform images onto a supported base** (Amazon Linux 2023, or a maintained slim/distroless JRE base) — primary ask.
2. Interim: rebuild current releases against latest AL2 ALAS patches before EOL.
3. Bump bundled agents to clear the two CRITICALs: `dd-java-agent` ≥ 1.60.3, `opentelemetry-javaagent` ≥ 2.26.1.
4. Refresh `netty`, `postgresql` JDBC, and `micronaut-context` to fixed versions.

### Relevant log output

```shell
$ docker run --rm --entrypoint sh airbyte/cron:2.1.0 -c 'cat /etc/os-release'
PRETTY_NAME="Amazon Linux 2"
CPE_NAME="cpe:2.3:o:amazon:amazon_linux:2"
SUPPORT_END="2026-06-30"

# Latest master build (as of 2026-06-23) is still Amazon Linux 2:
$ docker run --rm --entrypoint sh airbyte/cron:dev-303a200 -c 'grep -E "PRETTY_NAME|SUPPORT_END" /etc/os-release'
PRETTY_NAME="Amazon Linux 2"
SUPPORT_END="2026-06-30"
```

---
**Internal Tracking:** https://github.com/airbytehq/oncall/issues/12963

Start with the affected images listed in the issue: airbyte/cron, server, worker, workload-launcher, and workload-api-server. Reproduce with the provided docker run /etc/os-release commands and Trivy scan evidence. Done means the platform images use a supported base, the listed Java agents and dependencies are bumped, and scans no longer report the cited frozen EOL findings.

由索引模型根据 Issue 内容生成。