Weekly CVE pass 2026-08-09: one verified bump, harden the two bare apps - #77
Merged
Conversation
334 findings flagged; nine candidate bumps existed; scanning old vs new kept exactly one. Uptime Kuma 2.4.0 -> 2.5.0 fixes three CVEs and introduces none -- notably last week's 2.5.0 build was CVE-identical and rejected, while this week's rebuild of the same version carries the fixes, so version and digest genuinely move independently. Everything else with a newer artifact was count-identical, including litellm v1.95.0 and tailscale v1.102.2; mysql:latest scans 3 lower but is a major jump to 26.7, not an option for Ghost's LTS database. The 38 unfixed CRITICALs sit in the four new apps, all LAN/tailnet-gated. Fizzy's are genuinely reachable -- libraw/OpenEXR/ImageMagick decode attacker-supplied card images -- and it had zero hardening; now capped with a bare cap_drop ALL (verified safe: runs as uid 1000 from PID 1, no root-then-drop) and limits sized from measured steady state. Super Productivity hardened as defence in depth with the root-then-drop cap set since its nginx binds :80. Paperless and HedgeDoc were already hardened. All three deploys verified: Kuma with heartbeats flowing, Fizzy with secrets confirmed non-blank inside the container, SP serving. Also records the pass-cli session-wedge symptom and fix hit during deploy. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Trivy flagged 334 findings across 16 images (159 "fixable", 38 unfixed
CRITICAL). Applying the verify-before-bumping method: nine candidates had
newer artifacts, and one survived.
Applied and deployed
cap_drop: ALLverified safe (runs as uid 1000 from PID 1, no root-then-drop, checked withpodman top), limits sized from measured steady state (3.75 GB/151 PIDs → 6g/512)Rejected after verification
fizzy rebuild, hedgedoc rebuild, karakeep rebuild, litellm v1.95.0,
tailscale v1.102.2, ghost, traffic-analytics 1.0.329, mysql 8.4.11 — all
count-identical to what's pinned.
mysql:latestscans 3 lower but is MySQL26.7 — an innovation-release major jump for Ghost's LTS database; no.
No newer artifact exists for: super-productivity, paperless,
postgres:17-alpine, bookstack, wanderer-web, immich-server, apprise — their
"fixable" findings wait on upstream rebuilds.
Verification
the Pass-backed redeploy, endpoint serving
Also recorded
next scan re-reports that image once and prunes the 2.4.0 key. Expected.
infofails,loginsaysalready-authenticated): fix is clearing the scratch session dir. And the
tell for a genuinely broken deploy vs a benign one: warnings for every
Pass field vs a single genuinely-absent field.