ROB-1060: patch 29 CVEs on the kubewatch image - #115
Open
moshemorad wants to merge 1 commit into
Open
Conversation
The devel/kubewatch:v2.15.0 tag went 70 days without a rebuild and is past the 30-day deadline, carrying 2 critical / 17 high / 10 medium findings. All of them are fixable. - Pin the build image to golang:1.26.6 and set the go.mod toolchain to go1.26.6 so the binary is compiled with a patched standard library. Fixes 12 Go CVEs: CVE-2026-39822, CVE-2026-42505 (1.26.5) and CVE-2026-33818, CVE-2026-39821, CVE-2026-46600, CVE-2026-56853, CVE-2026-56858, CVE-2026-56859, CVE-2026-56860, CVE-2026-56862, CVE-2026-56864, CVE-2026-56865 (1.26.6). - Upgrade golang.org/x/net v0.38.0 -> v0.56.0. Fixes CVE-2026-25680 (the one the scan flagged) plus CVE-2025-47911, CVE-2025-58190, CVE-2026-33814, CVE-2026-42502, CVE-2026-42506, CVE-2026-25681, CVE-2026-27136, CVE-2026-39821 and CVE-2026-46600. v0.55.0 is not enough: CVE-2026-46600 (dns/dnsmessage panic) needs v0.56.0. - Upgrade golang.org/x/text v0.23.0 -> v0.39.0 (CVE-2026-56852), golang.org/x/sys v0.31.0 -> v0.46.0 (CVE-2026-39824) and github.com/klauspost/compress v1.17.9 -> v1.18.7 (GO-2026-5841). These are not in the current scan, but they are vulnerable at the pinned versions and would surface on the next one. The libcrypto3 (>= 3.6.3-r0) and libnghttp2-14 (>= 1.70.0-r0) findings need no source change - they come in with a rebuild on the current cgr.dev/chainguard/bash:latest base. All upgrades are indirect dependencies, so no kubewatch API surface changes. go build, go vet and govulncheck (source and binary mode) all pass clean; the pre-existing slackwebhook TestWebhookInit failure is unrelated and also fails on the parent commit. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CEtXkiNSDS47vF3x87V47L
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The devel/kubewatch:v2.15.0 tag went 70 days without a rebuild and is past the 30-day deadline, carrying 2 critical / 17 high / 10 medium findings. All of them are fixable.
Pin the build image to golang:1.26.6 and set the go.mod toolchain to go1.26.6 so the binary is compiled with a patched standard library. Fixes 12 Go CVEs: CVE-2026-39822, CVE-2026-42505 (1.26.5) and CVE-2026-33818, CVE-2026-39821, CVE-2026-46600, CVE-2026-56853, CVE-2026-56858, CVE-2026-56859, CVE-2026-56860, CVE-2026-56862, CVE-2026-56864, CVE-2026-56865 (1.26.6).
Upgrade golang.org/x/net v0.38.0 -> v0.56.0. Fixes CVE-2026-25680 (the one the scan flagged) plus CVE-2025-47911, CVE-2025-58190, CVE-2026-33814, CVE-2026-42502, CVE-2026-42506, CVE-2026-25681, CVE-2026-27136, CVE-2026-39821 and CVE-2026-46600. v0.55.0 is not enough: CVE-2026-46600 (dns/dnsmessage panic) needs v0.56.0.
Upgrade golang.org/x/text v0.23.0 -> v0.39.0 (CVE-2026-56852), golang.org/x/sys v0.31.0 -> v0.46.0 (CVE-2026-39824) and github.com/klauspost/compress v1.17.9 -> v1.18.7 (GO-2026-5841). These are not in the current scan, but they are vulnerable at the pinned versions and would surface on the next one.
The libcrypto3 (>= 3.6.3-r0) and libnghttp2-14 (>= 1.70.0-r0) findings need no source change - they come in with a rebuild on the current cgr.dev/chainguard/bash:latest base.
All upgrades are indirect dependencies, so no kubewatch API surface changes. go build, go vet and govulncheck (source and binary mode) all pass clean; the pre-existing slackwebhook TestWebhookInit failure is unrelated and also fails on the parent commit.
Claude-Session: https://claude.ai/code/session_01CEtXkiNSDS47vF3x87V47L
Tests performed