fix(docker): refresh vulnerable runtime packages

docker/Dockerfile

@@ -306,7 +306,15 @@ COPY --from=uv /uv /usr/local/bin/uv
 # 浏览器运行依赖
 RUN playwright install-deps chromium \
     && apt-get update \
-    && apt-get install -y --no-install-recommends libde265-0 \
+    && apt-get install -y --no-install-recommends \
+    gzip \
+    libde265-0 \
+    libpcre2-8-0 \
+    libsqlite3-0 \
+    nginx \
+    nginx-common \
+    xserver-common \
+    xvfb \
     && apt-get autoremove -y \
     && apt-get clean \
     && rm -rf \

tests/test_release_supply_chain.py

@@ -126,13 +126,21 @@ def test_base_image_uses_refreshable_tag_and_apt_does_not_upgrade_in_place() ->
     assert "ARG MOVIEPILOT_PYTHON_VERSION" in free_threaded_stage
     assert 'uv python install --no-bin "${MOVIEPILOT_PYTHON_VERSION}t"' in free_threaded_stage
     assert "apt-get upgrade" not in dockerfile
-    assert (
-        "apt-get install -y --no-install-recommends libde265-0"
-        in dockerfile
-    )
+    assert "apt-get install -y --no-install-recommends \\\n    gzip \\\n" in dockerfile
     assert "\n    libevent-2.1-7t64 \\\n" in dockerfile
     assert "\n    openssl \\\n" in dockerfile
     assert "\n    util-linux \\\n" in dockerfile
+    for package in (
+        "gzip",
+        "libde265-0",
+        "libpcre2-8-0",
+        "libsqlite3-0",
+        "nginx",
+        "nginx-common",
+        "xserver-common",
+        "xvfb",
+    ):
+        assert f"\n    {package} \\\n" in dockerfile
 
 
 def test_rclone_image_uses_cve_2026_46603_patched_build() -> None: