External/pmg
1
0
Fork 0
mirror of https://github.com/safedep/pmg.git synced 2026-08-03 07:24:09 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix(container): cut image vulnerabilities with x dep bumps and base image refresh (#394)

Browse Source 
* fix(deps): update golang.org/x modules to latest on the Go 1.25 line

Clears the x/crypto, x/net, x/sys and x/text vulnerability findings
reported against the pmg binary by image scanners.

Deliberately kept back: the go directive stays 1.25.1 because the Go
1.26 move is blocked on goproxy URL parsing (see #390), and grpc stays
pinned at v1.81.0 due to the trailers regression with v1.82.x.

* fix(container): move runtime base to debian 13 and refresh builder pin

The bullseye runtime base and the stale golang:1.25-bookworm digest
(go1.25.5) accounted for most of the vulnerability findings in the
published image. debian:13-slim is current stable and the refreshed
golang digest carries go1.25.12, covering every flagged stdlib CVE.
This commit is contained in:
Sahil Bansal
2026-07-27 17:42:51 +05:30
committed by GitHub
parent 47dd859756
commit d9240eed82
6 changed files with 33 additions and 34 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/go.mod
+3 -3
View File
@@ -16,9 +16,9 @@ require (
github.com/leodido/go-urn v1.4.0 // indirect
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
github.com/rogpeppe/go-internal v1.14.1 // indirect
golang.org/x/crypto v0.49.0 // indirect
golang.org/x/sys v0.43.0 // indirect
golang.org/x/text v0.35.0 // indirect
golang.org/x/crypto v0.54.0 // indirect
golang.org/x/sys v0.47.0 // indirect
golang.org/x/text v0.40.0 // indirect
gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c // indirect
gopkg.in/yaml.v3 v3.0.1 // indirect
)