Skip to content

Update brotli dependency to v1.2.7 (AST-189161) #1610

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
cx-aniket-shinde merged 6 commits into from
Nov 5, 2026
Merged

Update brotli dependency to v1.2.7 (AST-189161) #1610

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
a1685ac
Update github.com/andybalholm/brotli from v1.2.0 to v1.2.7 (AST-189161)
cx-anurag-dalke Nov 4, 2026
14c42db
Merge branch 'staging' into other/AST-189161
cx-anurag-dalke Nov 4, 2026
48c6a26
Update Docker base image checkmarx/bash:5.3 to latest digest (AST-189…
cx-anurag-dalke Nov 5, 2026
495f70d
Replace .trivyignore entries with current binary findings (AST-189161)
cx-anurag-dalke Nov 5, 2026
329c1cd
Restore syft and docker entries in .trivyignore (AST-189161)
cx-anurag-dalke Nov 5, 2026
9990e6f
Bump golang.org/x/net to v0.62.0 and trim .trivyignore (AST-189161)
cx-atish-jadhav Nov 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
51 changes: 11 additions & 40 deletions .trivyignore
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,44 +1,6 @@
# Trivy Ignore Configuration
# These vulnerabilities are in the Wolfi Linux base image or have compatibility issues

# ============================================================================
# BASE IMAGE VULNERABILITIES (Wolfi) - Cannot be patched by CLI code
# ============================================================================

# CVE-2026-8674: glibc DNS stub resolver DoS via long search domain
# Severity: MEDIUM
# Component: zlib 1.3.2-r6 (in Wolfi base image)
# Impact: Local DNS parsing issue - requires malformed DNS configuration
# Reason: Base image vulnerability - awaiting Wolfi update to zlib 1.3.2.1_rc20260601-r0
CVE-2026-8674

# CVE-2026-86805: glibc TOCTOU privilege escalation
# Severity: MEDIUM
# Component: glibc 2.44-r7 (in base image)
# Impact: Local attacker with file system access - requires race condition exploit
# Reason: Base image vulnerability - awaiting Wolfi update to glibc 2.44-r8
CVE-2026-86805

# CVE-2026-89092: glibc nscd stack overflow
# Severity: MEDIUM
# Component: glibc 2.44-r7 (in base image)
# Impact: Local DoS via nscd service - requires nscd to be running
# Reason: Base image vulnerability - awaiting Wolfi update to glibc 2.44-r8
CVE-2026-89092

# CVE-2026-95818: glibc local DoS and information disclosure
# Severity: MEDIUM
# Component: glibc 2.44-r7 (in base image)
# Impact: Local attacker can cause denial of service
# Reason: Base image vulnerability - awaiting Wolfi update to glibc 2.44-r8
CVE-2026-95818

# CVE-2026-85091: zlib heap buffer overflow
# Severity: MEDIUM
# Component: zlib 1.3.2-r6 (in Wolfi base image)
# Impact: Heap buffer overflow in compression library
# Reason: Base image vulnerability - awaiting Wolfi update to 1.3.2.1_rc20260601-r0
CVE-2026-85091
# These vulnerabilities are in Go dependencies that cannot be updated or fixed directly.
# Review periodically and remove entries once the underlying dependency is upgraded.

# ============================================================================
# BINARY VULNERABILITIES - Compatibility Issues (Not Updated)
Expand All @@ -62,3 +24,12 @@ CVE-2026-33481
# Docker plugin system - uses only core Docker SDK for container scanning.
# Status: Risk accepted - vulnerability not exploitable in CLI usage pattern
CVE-2026-33997

# GO-2026-5932: golang.org/x/crypto/openpgp is unmaintained and unsafe by design
# Severity: UNKNOWN
# Component: golang.org/x/crypto v0.58.0 (transitive via helm.sh/helm/v3/pkg/provenance)
# Reason: Not imported by ast-cli directly; the "fixed" version is an untagged pseudo-version.
# Awaiting Helm to drop x/crypto/openpgp.
# Impact: CLI does not perform OpenPGP signing/verification.
# Status: Risk accepted
GO-2026-5932
2 changes: 1 addition & 1 deletion Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
FROM checkmarx/bash:5.3-r14-365aa4c3c7b3fc@sha256:365aa4c3c7b3fcb580687c427e90ee9cda26e75cd12cae3a2b521777c0b4d3f3
FROM checkmarx/bash:5.3-r14-e52a196c3a914c@sha256:e52a196c3a914c6496c72465ad4a8f7efd1ff8ad988b328cbb92018652c23c7d
USER nonroot

COPY cx /app/bin/cx
Expand Down
4 changes: 2 additions & 2 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -102,7 +102,7 @@ require (
github.com/anchore/packageurl-go v0.1.1-0.20250220190351-d62adb6e1115 // indirect
github.com/anchore/stereoscope v0.1.0 // indirect
github.com/anchore/syft v1.21.0 // indirect
github.com/andybalholm/brotli v1.2.0 // indirect
github.com/andybalholm/brotli v1.2.7 // indirect
github.com/apparentlymart/go-textseg/v15 v15.0.0 // indirect
github.com/aquasecurity/go-pep440-version v0.0.1 // indirect
github.com/aquasecurity/go-version v0.0.1 // indirect
Expand Down Expand Up @@ -296,7 +296,7 @@ require (
go.yaml.in/yaml/v3 v3.0.4 // indirect
golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f // indirect
golang.org/x/mod v0.41.0 // indirect
golang.org/x/net v0.60.0 // indirect
golang.org/x/net v0.62.0 // indirect
golang.org/x/oauth2 v0.36.0 // indirect
golang.org/x/sys v0.49.0 // indirect
golang.org/x/term v0.47.0 // indirect
Expand Down
8 changes: 4 additions & 4 deletions go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -151,8 +151,8 @@ github.com/anchore/stereoscope v0.1.0/go.mod h1:3vasimie0IJOXvMbMpjwvwIHBDA1+192
github.com/anchore/syft v1.21.0 h1:JHmYOnEbCJsElROCCfg+3oIODw1LQLfXGkIrmXNZYsI=
github.com/anchore/syft v1.21.0/go.mod h1:8i8Yp/MiSOdqID0+6eiwE9bOJWM7fEBYitINZyr2G6s=
github.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883/go.mod h1:rCTlJbsFo29Kk6CurOXKm700vrz8f0KW0JNfpkRJY/8=
github.com/andybalholm/brotli v1.2.0 h1:ukwgCxwYrmACq68yiUqwIWnGY0cTPox/M94sVwToPjQ=
github.com/andybalholm/brotli v1.2.0/go.mod h1:rzTDkvFWvIrjDXZHkuS16NPggd91W3kUSvPlQ1pLaKY=
github.com/andybalholm/brotli v1.2.7 h1:UgafRPGMam5ySHfRkhthMqOFA6IFoeF3D7mWIDLjG5A=
github.com/andybalholm/brotli v1.2.7/go.mod h1:rzTDkvFWvIrjDXZHkuS16NPggd91W3kUSvPlQ1pLaKY=
github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be h1:9AeTilPcZAjCFIImctFaOjnTIavg87rW78vTPkQqLI8=
github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be/go.mod h1:ySMOLuWl6zY27l47sB3qLNK6tF2fkHG55UZxx8oIVo4=
github.com/antihax/optional v1.0.0/go.mod h1:uupD/76wgC+ih3iEmQUL+0Ugr19nfwCT1kdvxnR2qWY=
Expand Down Expand Up @@ -1201,8 +1201,8 @@ golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qx
golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU=
golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
golang.org/x/net v0.62.0 h1:18ELalfM5+XNRwzM2nYqXsZQ9ByS1uhj2O/U7+5jqRY=
golang.org/x/net v0.62.0/go.mod h1:WgDCOTH8iwtB66T4/GfI94AHo/hhdb7Hah9NDseQfiI=
golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
Expand Down
Loading