mirror of
https://github.com/snapotter-hq/SnapOtter.git
synced 2026-08-03 07:46:42 +02:00
SnapOtterandGitHub
c203267866
Reduces the container-image CVE surface flagged by Trivy. Genuinely fixed on every rebuild: - apt-get upgrade in the production stage pulls Ubuntu security patches for base-image packages (libgnutls30t64 3.8.3-1.1ubuntu3.5 -> ubuntu3.6, libgcrypt20, liblzma5), closing ~15 OS-package CVEs. - pip 25.1.1 -> 26.1.2 closes 4 pip CVEs (CVE-2025-8869, 2026-1703, 2026-3219, 2026-6357). Accepted via .trivyignore (canonical, reviewed): - 6 newly surfaced pnpm 9.x build-tool CVEs (fixed only in pnpm 10.x, a major migration tracked separately; pnpm runs at install/start only). - caire's bundled golang.org/x/image (esimov/caire v1.5.0 is latest and still pins x/image v0.18.0; no upstream fix). - brace-expansion 2.x ReDoS (transitive of glob; patched 5.0.6 already present; not reachable from user input). Already resolved in the current tree (clear on next scan): picomatch 4.0.4 (override), ip-address removed. Verification note: the Trivy job in release.yml depends on the intentionally gated-off docker build/publish job, so these cannot be re-scanned in CI without enabling image publishing. The image is not currently shipped.
51 lines
1.6 KiB
Plaintext
51 lines
1.6 KiB
Plaintext
# pnpm 9.x and its bundled dependencies
|
|
# These are build-time tool internals, not runtime application code.
|
|
# pnpm is only used for dependency installation and process management.
|
|
# All require upgrading to pnpm 10.x (major breaking change).
|
|
# Tracked: https://github.com/pnpm/pnpm/releases/tag/v10.0.0
|
|
|
|
# pnpm core
|
|
CVE-2025-69262
|
|
CVE-2025-69263
|
|
|
|
# glob (bundled in pnpm 9.x, not our dependency)
|
|
CVE-2025-64756
|
|
|
|
# minimatch (bundled in pnpm 9.x)
|
|
CVE-2026-26996
|
|
CVE-2026-27903
|
|
CVE-2026-27904
|
|
|
|
# picomatch (bundled in pnpm 9.x)
|
|
CVE-2026-33671
|
|
|
|
# tar (bundled in pnpm 9.x)
|
|
CVE-2026-23745
|
|
CVE-2026-23950
|
|
CVE-2026-24842
|
|
CVE-2026-26960
|
|
CVE-2026-29786
|
|
CVE-2026-31802
|
|
|
|
# pnpm 9.x core (2026 rescan) -- same build-time-tool rationale as above; every
|
|
# one of these is fixed only in pnpm 10.x (10.0.0 / 10.28.1 / 10.28.2), a major
|
|
# breaking migration tracked separately. pnpm runs only at install/start time.
|
|
CVE-2024-47829
|
|
CVE-2026-23888
|
|
CVE-2026-23889
|
|
CVE-2026-23890
|
|
CVE-2026-24056
|
|
CVE-2026-24131
|
|
|
|
# golang.org/x/image bundled in the caire binary (content-aware seam-carving
|
|
# resize, one tool). esimov/caire v1.5.0 is the latest release and still pins
|
|
# golang.org/x/image v0.18.0; there is no upstream caire build with the fixed
|
|
# x/image >=0.38.0. Re-evaluate when caire publishes a new release.
|
|
CVE-2026-33809
|
|
|
|
# brace-expansion: build-toolchain transitive of minimatch/glob. The patched
|
|
# instance (5.0.6) is already present; the only flagged copy is the 2.x line
|
|
# pulled by glob, whose fix is a major-version bump (5.0.5) the glob ecosystem
|
|
# has not adopted. Not reachable from user input.
|
|
CVE-2026-33750
|