Repository navigation
Bump APT_CACHE_BUST to clear 47 Trivy HIGH findings - #152
Merged
Merged
Conversation
The PR scan on #146 flagged 52 fixable HIGH CVEs. 47 are OS packages: libssl3t64, openssl and openssl-provider-legacy at 3.5.7-1~deb13u2, and linux-libc-dev at 6.12.107-1. The cached apt layer is stale again. A fresh apt layer built today gets openssl 3.5.7-1~deb13u3 and linux-libc-dev 6.12.111-1, which are the fixed versions. The other 5 findings (engine.io and brace-expansion) come from the snyk-broker fork and are fixed in cortexapps/snyk-broker#30. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
ashiramin
approved these changes
Sep 30, 2026
keithfz
enabled auto-merge (squash)
September 30, 2026 15:03
keithfz
added a commit
that referenced
this pull request
Sep 30, 2026
Picks up cortexapps/snyk-broker#30, which updates engine.io to 6.6.11 and the two brace-expansion copies to 2.1.7 and 1.1.21. This clears the 5 npm HIGH findings (CVE-2026-102599, CVE-2026-102276, CVE-2026-102278) under /usr/local/snyk-broker that the Trivy scan flagged. The OS-package findings from the same scan were cleared by #152. Updates both the production agent image and the test relay server image to the same snyk-broker fork tag. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The Trivy PR scan on #146 (run) found 52 fixable CRITICAL/HIGH CVEs.
OS packages (47): fixed here
Debian has these fixes in the archive now. The cached apt layer is stale. I ran the runtime-stage apt install on a clean
debian:stable-slimtoday, and it installs the fixed versions. This PR bumpsAPT_CACHE_BUSTto make buildx fetch again.npm packages (5): fixed in the fork
engine.io6.6.9 andbrace-expansion2.1.4 / 1.1.18 come from/usr/local/snyk-broker. The fix is in cortexapps/snyk-broker#30. After it merges and gets the tagv1.0.21-axon,SNYK_BROKER_VERSIONmust be bumped (in this PR or in a follow-up).🤖 Generated with Claude Code