Track release-image security findings in Apptainer/CNI and Nextflow dependencies #15

Problem

MetaPathways 4.0.0 release validation passed Conda installation/workflow integration, Docker workflow integration, and Apptainer artifact checks, but its Trivy security gate failed on third-party dependencies bundled in the release image.

Evidence: https://github.com/hallamlab/MetaPathways/actions/runs/38000115287
Download the container-security-report artifact for trivy.json and fixable-high-critical.json. These reports describe the scanned image, not the separately licensed Pathway Tools SIF.

The scan used Trivy 0.74.0 with --ignore-unfixed --severity HIGH,CRITICAL --exit-code 1. It reported 649 occurrences across 89 distinct vulnerability IDs, largely repeated across Apptainer/CNI binaries, plus Java libraries bundled in Nextflow. These are scanner findings; exploitability in MP has not been assessed individually.

The validated environment contains Apptainer 1.5.4, CNI 1.0.1, CNI plugins 1.3.0, and Nextflow 26.04.7. At review time these were the latest available packages in the configured channels.

Follow-up investigation (2026-10-09)

• Official Nextflow 26.09.2-edge passed a candidate Java scan for fixable HIGH/CRITICAL findings, but is a prerelease and has not passed MP workflow compatibility testing.
• Official Apptainer 1.5.4 trixie+ amd64 Debian binaries still had 464 fixable HIGH/CRITICAL occurrences in a separate candidate scan. This is a different artifact and is not directly comparable to the full image count.
• No dependency replacements, exclusions, or security-gate bypasses were applied. Custom rebuilds are deferred.

Completion criteria

• Check for patched upstream/Conda releases of Apptainer, CNI/CNI plugins and Nextflow.
• Rescan candidate binaries and the complete final image; retain reports.
• Assess remaining findings individually, documenting applicability and any narrowly scoped, time-limited exceptions.
• Verify clean installation, local workflow, Slurm workflow generation, Pathway Tools SIF creation/execution, Docker integration and MP Apptainer artifact checks after dependency changes.
• Resolve the release gate through fixes or an explicitly reviewed policy decision before publishing affected container artifacts.

This gate is HallamLab's repository policy, not an Anaconda upload requirement. Deferring the custom rebuild does not itself disable the gate or authorize publication.