Skip to content

Bump base image deps and improve image-scan workflow#39

Merged
dash14 merged 3 commits intomainfrom
update/deps-and-image-scan-workflow
Apr 5, 2026
Merged

Bump base image deps and improve image-scan workflow#39
dash14 merged 3 commits intomainfrom
update/deps-and-image-scan-workflow

Conversation

@dash14
Copy link
Copy Markdown
Owner

@dash14 dash14 commented Apr 5, 2026

Summary

  • Bump BuildKit from v0.28.0 to v0.29.0 and CNI plugins from v1.9.0 to v1.9.1
  • Output Trivy scan results as table in workflow logs for non-main branches, instead of uploading to GitHub Security
  • Add three new CVEs to .trivyignore after confirming no practical impact on this product:
    • CVE-2023-31922: QuickJS stack overflow — only internal scripts are executed; no untrusted JS input
    • CVE-2026-22184: zlib untgz demo utility buffer overflow — core libz is unaffected; untgz is not used
    • CVE-2026-25679: Go net/url IPv6 parsing — CNI plugins do not parse user-supplied URLs

@dash14 dash14 merged commit f75e451 into main Apr 5, 2026
6 checks passed
@dash14 dash14 deleted the update/deps-and-image-scan-workflow branch April 5, 2026 13:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant