Retriage ci-tools CVE suppressions and bump JS toolchain#198
Merged
Conversation
Suppress CVE-2026-39822 (os.Root symlink traversal) across actionlint, shfmt, and yq — no upstream build on the patched Go (1.25.12 / 1.26.5) exists yet. yq re-enters the cohort: its Go 1.26.4 build predates the fix. Drop four stale suppressions: - CVE-2026-39823, CVE-2026-39825 no longer appear in the scan. - CVE-2026-32316, CVE-2026-40164 cleared by jq 1.6-2.1+deb12u2 from the base-image bump. Extend the 11 remaining Go entries to 2026-09-01. Bump npm 11.18.0 to 12.0.1, biome 2.5.2 to 2.5.4, markdownlint-cli2 0.23.0 to 0.23.1.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The scheduled CVE monitor flagged fixable HIGH vulnerabilities in
ci-tools:latest. This retriages the full suppression set against a fresh unsuppressed scan and brings the JS toolchain current. The only genuinely new finding, CVE-2026-39822 (os.Root symlink following → directory traversal), has no patched upstream build yet — actionlint, shfmt, and yq are all already at their latest releases — so it is suppressed under the same offline-tool risk profile as the rest of the Go-stdlib cohort tracked in #96.Related Issues
Fixes #197
Changes
jq 1.6-2.1+deb12u2, pulled in by the recent base-image bump (debian now scans clean).expired_at: 2026-09-01.Further Comments
Verified locally:
make scanreports every gobinary and debian target at 0, andmake verify+make lint-lockfilepass on the rebuilt image. Suppression re-triage was driven by an unsuppressedtrivyscan rather than reasoning, so the retained set matches exactly what the scanner still reports. Details in the #96 status comment.