Repository navigation
fix: clear image CVEs (Go 1.26.10, x/crypto, go-jose v4) + fix-cves skill - #41
Merged
Merged
Conversation
The Trivy scan of the published 0.7.0 image flags Go standard-library CVEs in the binary, built with Go 1.26.6. HIGH: CVE-2026-111943 crypto/x509 fixed in 1.26.10 CVE-2026-78667 net/http fixed in 1.26.9 CVE-2026-78669 net/http fixed in 1.26.9 CVE-2026-97031 crypto/tls fixed in 1.26.9 plus ten MEDIUM/LOW ones fixed in 1.26.9, among them the html/template context-tracking fixes that govulncheck reports as called. Bump .go-version, the go.mod go directive, and the builder image in the Dockerfile (golang:1.26.10-alpine3.24, pinned by digest). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…-78662 golang.org/x/crypto v0.55.0 carries two MEDIUM x/crypto/ssh denial-of- service CVEs (CVE-2026-56855, CVE-2026-78662), fixed in v0.56.0. axoidp does not import x/crypto/ssh, so neither is reachable; the bump keeps the image scan clean. go mod tidy also bumped golang.org/x/sys v0.47.0 -> v0.49.0. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
go-jose v3 carries three denial-of-service advisories with no v3 fix: CVE-2026-116587 HIGH GHSA-mgcc-cww5-fp2q RSA parameters in JWKs v4.1.6 CVE-2026-116585 MEDIUM GHSA-4w3g-jfj2-cw2q CBC-HMAC panic v4.1.5 CVE-2026-116586 MEDIUM GHSA-vvm8-gf78-28g4 JSON parsing panics v4.1.5 /oidc/userinfo parses the unauthenticated bearer token with go-jose, so the parser is reachable by any client. v4 deprecates ParseSigned for ParseSignedCompact, which also takes the allowed signature algorithms. Tokens are compact JWS signed with RS256 only, so accept exactly that. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The verify recipe runs lint-go, license-check and test; editor-config is a separate recipe that neither verify nor CI runs. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Encodes the routine: scan the latest release image with Trivy, check reachability with govulncheck, triage into a Go toolchain bump, a module bump or a major-version migration, apply one commit per package behind the repo gates, then rescan the local image twice on the same DB. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
csatib02
approved these changes
Nov 4, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Clears every Trivy finding on the published
0.7.0image except one informational notice, and adds a skill that records the routine.CVE fixes
.go-version,go.mod, builder image by digest)golang.org/x/cryptox/sys→ v0.49.0)x/crypto/ssh, not imported)go-josego-jose v3 has no fix for these advisories; only v4 does.
/oidc/userinfoparses an unauthenticated bearer token with go-jose, so the parser is reachable. v4 deprecatesParseSigned, so the token is now parsed withParseSignedCompactand onlyRS256is allowed — the only algorithm the provider signs with.Left open: GO-2026-5932 (
x/crypto/openpgpunmaintained notice, severity UNKNOWN, not imported, no tagged fix).Rebase note: PRs that add
jose.ParseSignedcalls (#29, #13) need the v4 import andParseSignedCompact(…, []jose.SignatureAlgorithm{jose.RS256})after this merges.Docs and skill
CLAUDE.md:just verifyruns lint, license check and tests; it does not run editorconfig..claude/skills/fix-cves/SKILL.md: scan the latest release with Trivy, check reachability with govulncheck, triage, one commit per package behind the repo gates, rescan twice on the same DB.Verification
just verify,just test-race,just test-e2e(23 tests): pass.just image, then Trivy 0.69.3 twice on the local image (DB2026-11-04T07:16Z): identical results, 0 CRITICAL/HIGH/MEDIUM/LOW; the Go binary still lists its packages.🤖 Generated with Claude Code