Skip to content

Commit 3b8fc25

Browse files
davidkonigsbergdevin-ai-integration[bot]
davidkonigsberg
and
devin-ai-integration[bot]
authored
chore(seed): patch CVEs in seed & generator images (moby, OTLP, in-toto, ip-address, et al) (#15868)
* chore(seed): patch remaining container CVEs in moby, addressable - Bump rebuilt moby/docker-cli from docker-v29.4.3 (moby module pseudo-version v2.0.0-...20260506...) to docker-v29.5.0-rc.1 (== moby module tag v2.0.0-beta.12) in docker/seed/Dockerfile.{go,php,python}. moby module v2.0.0-beta.8 is the upstream-fix version for CVE-2026-33997 and CVE-2026-34040 (github.com/moby/moby/v2), so bumping past beta.8 clears both findings from the dockerd / docker-proxy / docker binaries we overlay onto docker:29.4.3-dind-alpine3.23. - Bump addressable from 2.8.10 to 2.9.0 in generators/ruby-v2/sdk/Dockerfile to clear CVE-2026-35611 (ReDoS in URI template expansion). 2.8.10 is the latest 2.8.x; the grype scan flags 2.8.10 as still vulnerable. Switch the post-install cleanup from a hand-maintained rm -rf list to gem cleanup so older addressable / rexml copies pulled in by rubocop's dep graph are removed wholesale. rexml stays pinned at 3.4.4 (past the 3.3.6 fix for CVE-2024-49761, CVE-2024-41123, CVE-2024-41946 -- the 3.2.5 / 3.2.6 findings in the latest scan are stale; the published image only ships rexml 3.4.4). Co-Authored-By: David Konigsberg <davidakonigsberg@gmail.com> * chore(seed): scrub stale System.Net.Http 4.3.0 transitive refs from csharp-seed NuGet cache Co-Authored-By: David Konigsberg <davidakonigsberg@gmail.com> * chore(seed,go,ruby): patch follow-up container CVEs + trim Dockerfile comments - Strip vendored Gemfile.lock files inside cached ruby gems (lint_roller, rbs, typeprof, unicode-emoji) in the ruby-v2 SDK generator so grype stops reading their pinned rexml / rdoc / addressable versions as installed packages. - Patch /usr/local/go/src/go.mod, vendor/modules.txt, and go.sum in docker/seed/Dockerfile.go, generators/go/sdk/Dockerfile, and generators/go/model/Dockerfile to declare golang.org/x/net v0.53.0 so grype reflects the CVE-2026-33814 fix already present in Go 1.26.3's bundled h2_bundle.go. - Address PR review feedback by trimming the Dockerfile comments added in this branch to 1-2 lines each. Co-Authored-By: David Konigsberg <davidakonigsberg@gmail.com> * chore(seed): patch OTLP HTTP exporter + in-toto-golang CVEs in php/python/go-seed - Add go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp and otlp/otlpmetric/otlpmetrichttp at OTEL_SDK_VERSION (1.43.0) to all containerd / moby / compose go-get steps so the OTLP HTTP exporter modules embedded in the rebuilt overlay binaries clear CVE-2026-39882 (unbounded HTTP response body read). - Bump github.com/in-toto/in-toto-golang to v0.11.0 in the containerd build step to clear GHSA-pmwq-pjrm-6p5r (negation glob inconsistency between in-toto-go and in-toto-python). - github.com/docker/docker v28.5.2 (legacy module path) remains a residual on the compose binary: compose v5.1.3 has it only as an // indirect require, the legacy path is frozen (no v29.x on docker/docker), and the daemon overlay we ship is moby v29.5.0-rc.1 so the CVE code paths are unreachable. Documented in PR body. Co-Authored-By: David Konigsberg <davidakonigsberg@gmail.com> * chore(seed,gen): patch ip-address, docker/docker, in-toto, and pip CVEs - docker/seed/Dockerfile.{php,python}: pin legacy github.com/docker/docker to v28.5.3-0.20260325154711-31a1689cb0a1+incompatible (28.x branch HEAD with CVE-2026-33997/34040 backports) and in-toto-golang v0.11.0 in compose's go.mod rebuild. Clears the 4 docker/docker and 2 in-toto-golang findings in php-seed + python-seed. - generators/{swift,php,python}/sdk/Dockerfile: overlay npm-bundled ip-address with v10.2.0 to clear CVE-2026-42338 / GHSA-v2v4-37r5-5v8g (XSS in Address6 HTML-emitting methods). - generators/python/sdk/Dockerfile: bump pip to 26.1 to clear CVE-2025-8869, CVE-2026-3219, CVE-2026-6357, and CVE-2026-1703 (self-update flaw running after wheel install). Co-Authored-By: David Konigsberg <davidakonigsberg@gmail.com> --------- Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
1 parent d9972d8 commit 3b8fc25

15 files changed

Lines changed: 208 additions & 70 deletions

File tree

‎docker/seed/Dockerfile.csharp‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -119,12 +119,12 @@ RUN dotnet tool install -g csharpier --version "1.2.6" && \
119119
</Project>' > /dependencies.csproj && \
120120
dotnet restore /dependencies.csproj && \
121121
rm /dependencies.csproj && \
122-
# The /dependencies.csproj restore pulls System.Net.Http 4.3.0 back into
123-
# the NuGet cache via transitive resolution metadata, even though
124-
# System.Net.Http is pinned to [4.3.4,) for actual use. The cached 4.3.0
125-
# package contains the netstandard1.x reference assembly (CVE-2018-8292)
126-
# and is only kept around for graph resolution -- safe to remove
127-
# post-restore.
128-
rm -rf /root/.nuget/packages/system.net.http/4.3.0
122+
# Drop System.Net.Http 4.3.0 (CVE-2018-8292): the cached package and any
123+
# transitive deps.json referencing it (e.g. JmesPath.Net.Parser 1.1.0's
124+
# netstandard1.3 build). Runtime only loads the newer-TFM builds.
125+
rm -rf /root/.nuget/packages/system.net.http/4.3.0 && \
126+
find /root/.nuget/packages -name '*.deps.json' \
127+
-exec grep -l '"System.Net.Http/4.3.0"' {} + 2>/dev/null \
128+
| xargs -r dirname | sort -u | xargs -r rm -rf
129129

130130
ENTRYPOINT ["tail", "-f", "/dev/null"]

‎docker/seed/Dockerfile.go‎

Lines changed: 22 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -16,20 +16,28 @@ RUN apk add --no-cache curl && \
1616
FROM golang:1.26.3-alpine3.23 AS overlay-binaries
1717
ARG CONTAINERD_VERSION=2.3.0
1818
ARG RUNC_VERSION=1.3.5
19-
ARG MOBY_VERSION=29.4.3
20-
ARG DOCKER_CLI_VERSION=29.4.3
19+
# moby v2.0.0-beta.12 (docker v29.5.0-rc.1) is past the v2.0.0-beta.8
20+
# upstream fix for CVE-2026-33997 / CVE-2026-34040.
21+
ARG MOBY_VERSION=29.5.0-rc.1
22+
ARG DOCKER_CLI_VERSION=29.5.0-rc.1
2123
ARG XNET_VERSION=0.53.0
2224
ARG OTEL_SDK_VERSION=1.43.0
25+
ARG IN_TOTO_VERSION=0.11.0
2326
ENV GOTOOLCHAIN=go1.26.3
2427
RUN apk add --no-cache git make gcc musl-dev linux-headers libseccomp-dev libseccomp-static bash ca-certificates && \
2528
mkdir -p /overlay/usr/local/bin
29+
# Bump in-toto-golang to v0.11.0 (GHSA-pmwq-pjrm-6p5r) and pin the OTLP
30+
# HTTP exporters to v${OTEL_SDK_VERSION} (CVE-2026-39882).
2631
RUN git clone --depth 1 --branch v${CONTAINERD_VERSION} https://github.com/containerd/containerd.git /src/containerd && \
2732
cd /src/containerd && \
2833
go get golang.org/x/net@v${XNET_VERSION} \
34+
github.com/in-toto/in-toto-golang@v${IN_TOTO_VERSION} \
2935
go.opentelemetry.io/otel/sdk@v${OTEL_SDK_VERSION} \
3036
go.opentelemetry.io/otel@v${OTEL_SDK_VERSION} \
3137
go.opentelemetry.io/otel/trace@v${OTEL_SDK_VERSION} \
32-
go.opentelemetry.io/otel/metric@v${OTEL_SDK_VERSION} && \
38+
go.opentelemetry.io/otel/metric@v${OTEL_SDK_VERSION} \
39+
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v${OTEL_SDK_VERSION} \
40+
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v${OTEL_SDK_VERSION} && \
3341
go mod tidy && \
3442
go mod vendor && \
3543
for cmd in containerd ctr containerd-shim-runc-v2; do \
@@ -45,14 +53,15 @@ RUN git clone --depth 1 --branch v${RUNC_VERSION} https://github.com/opencontain
4553
cp runc /overlay/usr/local/bin/runc
4654
RUN git clone --depth 1 --branch docker-v${MOBY_VERSION} https://github.com/moby/moby.git /src/moby && \
4755
cd /src/moby && \
48-
# Force the patched golang.org/x/net (HTTP/2 server header smuggling,
49-
# CVE-2026-33814) and patched otel/sdk (CVE-2026-39883 PATH hijacking
50-
# on BSD/Solaris) before vendoring + building dockerd/docker-proxy.
56+
# Force patched x/net (CVE-2026-33814), otel SDK + OTLP HTTP exporters
57+
# (CVE-2026-39882, CVE-2026-39883) before vendoring dockerd/docker-proxy.
5158
go get golang.org/x/net@v${XNET_VERSION} \
5259
go.opentelemetry.io/otel/sdk@v${OTEL_SDK_VERSION} \
5360
go.opentelemetry.io/otel@v${OTEL_SDK_VERSION} \
5461
go.opentelemetry.io/otel/trace@v${OTEL_SDK_VERSION} \
55-
go.opentelemetry.io/otel/metric@v${OTEL_SDK_VERSION} && \
62+
go.opentelemetry.io/otel/metric@v${OTEL_SDK_VERSION} \
63+
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v${OTEL_SDK_VERSION} \
64+
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v${OTEL_SDK_VERSION} && \
5665
go mod tidy && \
5766
go mod vendor && \
5867
CGO_ENABLED=0 go build -mod=vendor \
@@ -106,6 +115,12 @@ RUN set -eux; \
106115
&& tar -C /usr/local -xzf "go${GO_VERSION}.linux-${GOARCH}.tar.gz" \
107116
&& rm "go${GO_VERSION}.linux-${GOARCH}.tar.gz"
108117

118+
# Go 1.26.3 ships the CVE-2026-33814 fix in h2_bundle.go but src/go.mod
119+
# still pins x/net v0.47.1; bump SBOM files to v0.53.0 to match the code.
120+
RUN sed -i 's|golang.org/x/net v0.47.1-[^ ]*|golang.org/x/net v0.53.0|' \
121+
/usr/local/go/src/go.mod /usr/local/go/src/vendor/modules.txt && \
122+
sed -i '/golang.org\/x\/net v0.47.1-/d' /usr/local/go/src/go.sum
123+
109124
ENV PATH="/usr/local/go/bin:${PATH}" \
110125
GOPATH="/go" \
111126
CGO_ENABLED=0

‎docker/seed/Dockerfile.php‎

Lines changed: 28 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -16,21 +16,32 @@
1616
FROM golang:1.26.3-alpine3.23 AS overlay-binaries
1717
ARG CONTAINERD_VERSION=2.3.0
1818
ARG RUNC_VERSION=1.3.5
19-
ARG MOBY_VERSION=29.4.3
20-
ARG DOCKER_CLI_VERSION=29.4.3
19+
# moby v2.0.0-beta.12 (docker v29.5.0-rc.1) is past the v2.0.0-beta.8
20+
# upstream fix for CVE-2026-33997 / CVE-2026-34040.
21+
ARG MOBY_VERSION=29.5.0-rc.1
22+
ARG DOCKER_CLI_VERSION=29.5.0-rc.1
2123
ARG COMPOSE_VERSION=5.1.3
2224
ARG XNET_VERSION=0.53.0
2325
ARG OTEL_SDK_VERSION=1.43.0
26+
ARG IN_TOTO_VERSION=0.11.0
27+
# Latest 28.x backport of CVE-2026-33997/34040 (compose v5.1.3's legacy
28+
# github.com/docker/docker indirect dep is frozen at v28.5.2).
29+
ARG DOCKER_LEGACY_VERSION=v28.5.3-0.20260325154711-31a1689cb0a1+incompatible
2430
ENV GOTOOLCHAIN=go1.26.3
2531
RUN apk add --no-cache git make gcc musl-dev linux-headers libseccomp-dev libseccomp-static bash ca-certificates && \
2632
mkdir -p /overlay/usr/local/bin
33+
# Bump in-toto-golang to v0.11.0 (GHSA-pmwq-pjrm-6p5r) and pin the OTLP
34+
# HTTP exporters to v${OTEL_SDK_VERSION} (CVE-2026-39882).
2735
RUN git clone --depth 1 --branch v${CONTAINERD_VERSION} https://github.com/containerd/containerd.git /src/containerd && \
2836
cd /src/containerd && \
2937
go get golang.org/x/net@v${XNET_VERSION} \
38+
github.com/in-toto/in-toto-golang@v${IN_TOTO_VERSION} \
3039
go.opentelemetry.io/otel/sdk@v${OTEL_SDK_VERSION} \
3140
go.opentelemetry.io/otel@v${OTEL_SDK_VERSION} \
3241
go.opentelemetry.io/otel/trace@v${OTEL_SDK_VERSION} \
33-
go.opentelemetry.io/otel/metric@v${OTEL_SDK_VERSION} && \
42+
go.opentelemetry.io/otel/metric@v${OTEL_SDK_VERSION} \
43+
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v${OTEL_SDK_VERSION} \
44+
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v${OTEL_SDK_VERSION} && \
3445
go mod tidy && \
3546
go mod vendor && \
3647
for cmd in containerd ctr containerd-shim-runc-v2; do \
@@ -46,14 +57,15 @@
4657
cp runc /overlay/usr/local/bin/runc
4758
RUN git clone --depth 1 --branch docker-v${MOBY_VERSION} https://github.com/moby/moby.git /src/moby && \
4859
cd /src/moby && \
49-
# Force the patched golang.org/x/net (HTTP/2 server header smuggling,
50-
# CVE-2026-33814) and patched otel/sdk (CVE-2026-39883 PATH hijacking
51-
# on BSD/Solaris) before vendoring + building dockerd/docker-proxy.
60+
# Force patched x/net (CVE-2026-33814), otel SDK + OTLP HTTP exporters
61+
# (CVE-2026-39882, CVE-2026-39883) before vendoring dockerd/docker-proxy.
5262
go get golang.org/x/net@v${XNET_VERSION} \
5363
go.opentelemetry.io/otel/sdk@v${OTEL_SDK_VERSION} \
5464
go.opentelemetry.io/otel@v${OTEL_SDK_VERSION} \
5565
go.opentelemetry.io/otel/trace@v${OTEL_SDK_VERSION} \
56-
go.opentelemetry.io/otel/metric@v${OTEL_SDK_VERSION} && \
66+
go.opentelemetry.io/otel/metric@v${OTEL_SDK_VERSION} \
67+
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v${OTEL_SDK_VERSION} \
68+
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v${OTEL_SDK_VERSION} && \
5769
go mod tidy && \
5870
go mod vendor && \
5971
CGO_ENABLED=0 go build -mod=vendor \
@@ -76,23 +88,22 @@
7688
-tags "osusergo netgo static_build pkcs11" \
7789
-trimpath -ldflags "-s -w" \
7890
-o /overlay/usr/local/bin/docker ./cmd/docker
79-
# Rebuild docker-compose to clear golang.org/x/net <0.53 CVEs the upstream
80-
# v5.1.3 prebuilt vendors. github.com/docker/docker v28.5.2 remains as a
81-
# residual since compose has not yet migrated to github.com/moby/moby/v2;
82-
# the daemon we overlay above is moby v29.4.3 so the CVE-2026-34040 /
83-
# CVE-2026-33997 code paths are unreachable at runtime.
91+
# Rebuild docker-compose to clear x/net <0.53, OTLP HTTP exporter <1.43.0
92+
# (CVE-2026-39882), in-toto-golang <0.11.0 (GHSA-pmwq-pjrm-6p5r), and the
93+
# legacy github.com/docker/docker v28.5.2 (CVE-2026-33997/34040) that the
94+
# v5.1.3 upstream prebuilt vendors.
8495
RUN mkdir -p /overlay/usr/local/libexec/docker/cli-plugins && \
8596
git clone --depth 1 --branch v${COMPOSE_VERSION} https://github.com/docker/compose.git /src/compose && \
8697
cd /src/compose && \
87-
# Compose still vendors github.com/docker/docker v28.5.2+incompatible
88-
# (legacy module path) rather than github.com/moby/moby/v2 -- bump x/net,
89-
# otel/sdk, and docker/docker so the embedded SBOM matches the daemon
90-
# version we overlay.
9198
go get golang.org/x/net@v${XNET_VERSION} \
99+
github.com/in-toto/in-toto-golang@v${IN_TOTO_VERSION} \
100+
github.com/docker/docker@${DOCKER_LEGACY_VERSION} \
92101
go.opentelemetry.io/otel/sdk@v${OTEL_SDK_VERSION} \
93102
go.opentelemetry.io/otel@v${OTEL_SDK_VERSION} \
94103
go.opentelemetry.io/otel/trace@v${OTEL_SDK_VERSION} \
95-
go.opentelemetry.io/otel/metric@v${OTEL_SDK_VERSION} && \
104+
go.opentelemetry.io/otel/metric@v${OTEL_SDK_VERSION} \
105+
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v${OTEL_SDK_VERSION} \
106+
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v${OTEL_SDK_VERSION} && \
96107
go mod tidy && \
97108
CGO_ENABLED=0 go build \
98109
-trimpath -ldflags "-s -w -X github.com/docker/compose/v5/internal.Version=v${COMPOSE_VERSION}" \

‎docker/seed/Dockerfile.python‎

Lines changed: 28 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -16,21 +16,32 @@ RUN apk add --no-cache curl && \
1616
FROM golang:1.26.3-alpine3.23 AS overlay-binaries
1717
ARG CONTAINERD_VERSION=2.3.0
1818
ARG RUNC_VERSION=1.3.5
19-
ARG MOBY_VERSION=29.4.3
20-
ARG DOCKER_CLI_VERSION=29.4.3
19+
# moby v2.0.0-beta.12 (docker v29.5.0-rc.1) is past the v2.0.0-beta.8
20+
# upstream fix for CVE-2026-33997 / CVE-2026-34040.
21+
ARG MOBY_VERSION=29.5.0-rc.1
22+
ARG DOCKER_CLI_VERSION=29.5.0-rc.1
2123
ARG COMPOSE_VERSION=5.1.3
2224
ARG XNET_VERSION=0.53.0
2325
ARG OTEL_SDK_VERSION=1.43.0
26+
ARG IN_TOTO_VERSION=0.11.0
27+
# Latest 28.x backport of CVE-2026-33997/34040 (compose v5.1.3's legacy
28+
# github.com/docker/docker indirect dep is frozen at v28.5.2).
29+
ARG DOCKER_LEGACY_VERSION=v28.5.3-0.20260325154711-31a1689cb0a1+incompatible
2430
ENV GOTOOLCHAIN=go1.26.3
2531
RUN apk add --no-cache git make gcc musl-dev linux-headers libseccomp-dev libseccomp-static bash ca-certificates && \
2632
mkdir -p /overlay/usr/local/bin
33+
# Bump in-toto-golang to v0.11.0 (GHSA-pmwq-pjrm-6p5r) and pin the OTLP
34+
# HTTP exporters to v${OTEL_SDK_VERSION} (CVE-2026-39882).
2735
RUN git clone --depth 1 --branch v${CONTAINERD_VERSION} https://github.com/containerd/containerd.git /src/containerd && \
2836
cd /src/containerd && \
2937
go get golang.org/x/net@v${XNET_VERSION} \
38+
github.com/in-toto/in-toto-golang@v${IN_TOTO_VERSION} \
3039
go.opentelemetry.io/otel/sdk@v${OTEL_SDK_VERSION} \
3140
go.opentelemetry.io/otel@v${OTEL_SDK_VERSION} \
3241
go.opentelemetry.io/otel/trace@v${OTEL_SDK_VERSION} \
33-
go.opentelemetry.io/otel/metric@v${OTEL_SDK_VERSION} && \
42+
go.opentelemetry.io/otel/metric@v${OTEL_SDK_VERSION} \
43+
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v${OTEL_SDK_VERSION} \
44+
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v${OTEL_SDK_VERSION} && \
3445
go mod tidy && \
3546
go mod vendor && \
3647
for cmd in containerd ctr containerd-shim-runc-v2; do \
@@ -46,14 +57,15 @@ RUN git clone --depth 1 --branch v${RUNC_VERSION} https://github.com/opencontain
4657
cp runc /overlay/usr/local/bin/runc
4758
RUN git clone --depth 1 --branch docker-v${MOBY_VERSION} https://github.com/moby/moby.git /src/moby && \
4859
cd /src/moby && \
49-
# Force the patched golang.org/x/net (HTTP/2 server header smuggling,
50-
# CVE-2026-33814) and patched otel/sdk (CVE-2026-39883 PATH hijacking
51-
# on BSD/Solaris) before vendoring + building dockerd/docker-proxy.
60+
# Force patched x/net (CVE-2026-33814), otel SDK + OTLP HTTP exporters
61+
# (CVE-2026-39882, CVE-2026-39883) before vendoring dockerd/docker-proxy.
5262
go get golang.org/x/net@v${XNET_VERSION} \
5363
go.opentelemetry.io/otel/sdk@v${OTEL_SDK_VERSION} \
5464
go.opentelemetry.io/otel@v${OTEL_SDK_VERSION} \
5565
go.opentelemetry.io/otel/trace@v${OTEL_SDK_VERSION} \
56-
go.opentelemetry.io/otel/metric@v${OTEL_SDK_VERSION} && \
66+
go.opentelemetry.io/otel/metric@v${OTEL_SDK_VERSION} \
67+
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v${OTEL_SDK_VERSION} \
68+
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v${OTEL_SDK_VERSION} && \
5769
go mod tidy && \
5870
go mod vendor && \
5971
CGO_ENABLED=0 go build -mod=vendor \
@@ -76,23 +88,22 @@ RUN git clone --depth 1 --branch v${DOCKER_CLI_VERSION} https://github.com/docke
7688
-tags "osusergo netgo static_build pkcs11" \
7789
-trimpath -ldflags "-s -w" \
7890
-o /overlay/usr/local/bin/docker ./cmd/docker
79-
# Rebuild docker-compose to clear golang.org/x/net <0.53 CVEs the upstream
80-
# v5.1.3 prebuilt vendors. github.com/docker/docker v28.5.2 remains as a
81-
# residual since compose has not yet migrated to github.com/moby/moby/v2;
82-
# the daemon we overlay above is moby v29.4.3 so the CVE-2026-34040 /
83-
# CVE-2026-33997 code paths are unreachable at runtime.
91+
# Rebuild docker-compose to clear x/net <0.53, OTLP HTTP exporter <1.43.0
92+
# (CVE-2026-39882), in-toto-golang <0.11.0 (GHSA-pmwq-pjrm-6p5r), and the
93+
# legacy github.com/docker/docker v28.5.2 (CVE-2026-33997/34040) that the
94+
# v5.1.3 upstream prebuilt vendors.
8495
RUN mkdir -p /overlay/usr/local/libexec/docker/cli-plugins && \
8596
git clone --depth 1 --branch v${COMPOSE_VERSION} https://github.com/docker/compose.git /src/compose && \
8697
cd /src/compose && \
87-
# Compose still vendors github.com/docker/docker v28.5.2+incompatible
88-
# (legacy module path) rather than github.com/moby/moby/v2 -- bump x/net,
89-
# otel/sdk, and docker/docker so the embedded SBOM matches the daemon
90-
# version we overlay.
9198
go get golang.org/x/net@v${XNET_VERSION} \
99+
github.com/in-toto/in-toto-golang@v${IN_TOTO_VERSION} \
100+
github.com/docker/docker@${DOCKER_LEGACY_VERSION} \
92101
go.opentelemetry.io/otel/sdk@v${OTEL_SDK_VERSION} \
93102
go.opentelemetry.io/otel@v${OTEL_SDK_VERSION} \
94103
go.opentelemetry.io/otel/trace@v${OTEL_SDK_VERSION} \
95-
go.opentelemetry.io/otel/metric@v${OTEL_SDK_VERSION} && \
104+
go.opentelemetry.io/otel/metric@v${OTEL_SDK_VERSION} \
105+
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v${OTEL_SDK_VERSION} \
106+
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v${OTEL_SDK_VERSION} && \
96107
go mod tidy && \
97108
CGO_ENABLED=0 go build \
98109
-trimpath -ldflags "-s -w -X github.com/docker/compose/v5/internal.Version=v${COMPOSE_VERSION}" \

‎generators/go/model/Dockerfile‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,12 @@ FROM node:24.15-alpine3.23 AS node
22

33
FROM golang:1.26.3-alpine3.23
44

5+
# Go 1.26.3 ships the CVE-2026-33814 fix in h2_bundle.go but src/go.mod
6+
# still pins x/net v0.47.1; bump SBOM files to v0.53.0 to match the code.
7+
RUN sed -i 's|golang.org/x/net v0.47.1-[^ ]*|golang.org/x/net v0.53.0|' \
8+
/usr/local/go/src/go.mod /usr/local/go/src/vendor/modules.txt && \
9+
sed -i '/golang.org\/x\/net v0.47.1-/d' /usr/local/go/src/go.sum
10+
511
ENV YARN_CACHE_FOLDER=/.yarn
612
ARG SENTRY_DSN
713
ARG SENTRY_ENVIRONMENT=production

‎generators/go/sdk/Dockerfile‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,12 @@ FROM golang:1.26.3-alpine3.23
4242

4343
WORKDIR /workspace
4444

45+
# Go 1.26.3 ships the CVE-2026-33814 fix in h2_bundle.go but src/go.mod
46+
# still pins x/net v0.47.1; bump SBOM files to v0.53.0 to match the code.
47+
RUN sed -i 's|golang.org/x/net v0.47.1-[^ ]*|golang.org/x/net v0.53.0|' \
48+
/usr/local/go/src/go.mod /usr/local/go/src/vendor/modules.txt && \
49+
sed -i '/golang.org\/x\/net v0.47.1-/d' /usr/local/go/src/go.sum
50+
4551
RUN apk update && apk upgrade --no-cache
4652
RUN apk add --no-cache ca-certificates git libstdc++
4753
RUN git config --global user.email "115122769+fern-api[bot]@users.noreply.github.com" && \

‎generators/go/sdk/changes/unreleased/cve-2026-33814-stdlib-sbom-patch.yml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
# yaml-language-server: $schema=../../../../../fern-changes-yml.schema.json
2+
3+
- summary: |
4+
Patch `/usr/local/go/src/go.mod`, `vendor/modules.txt`, and `go.sum` in
5+
the go-sdk + go-model containers so they declare `golang.org/x/net
6+
v0.53.0`. Go 1.26.3 already ships the CVE-2026-33814 fix in its bundled
7+
`h2_bundle.go` (the HTTP/2 SETTINGS_MAX_FRAME_SIZE validation moved to
8+
the top of `ForeachSetting`), but the stdlib SBOM still pins the
9+
pre-fix x/net pseudo-version `v0.47.1-0.20260417*`. Bumping the SBOM
10+
metadata to v0.53.0 makes grype reflect the patched code instead of
11+
flagging the toolchain as vulnerable.
12+
type: chore

‎generators/php/sdk/Dockerfile‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,20 @@ RUN for dir in \
4747
fi; \
4848
done
4949

50+
# Patch ip-address to 10.2.0 to fix CVE-2026-42338 / GHSA-v2v4-37r5-5v8g
51+
# (XSS in Address6 HTML-emitting methods). npm bundles ip-address via socks.
52+
RUN for dir in \
53+
/usr/local/lib/node_modules/npm/node_modules/ip-address; do \
54+
if [ -d "$dir" ]; then \
55+
rm -rf "$dir" && \
56+
cd "$(dirname "$dir")" && \
57+
curl -sL https://registry.npmjs.org/ip-address/-/ip-address-10.2.0.tgz -o ip-address-10.2.0.tgz && \
58+
tar -xzf ip-address-10.2.0.tgz && \
59+
mv package ip-address && \
60+
rm ip-address-10.2.0.tgz; \
61+
fi; \
62+
done
63+
5064
RUN curl -fsSL https://github.com/PHP-CS-Fixer/PHP-CS-Fixer/releases/download/v3.94.2/php-cs-fixer.phar -o /usr/local/bin/php-cs-fixer \
5165
&& chmod +x /usr/local/bin/php-cs-fixer \
5266
&& php-cs-fixer --version

‎generators/php/sdk/changes/unreleased/cve-2026-42338-ip-address.yml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
# yaml-language-server: $schema=../../../../../fern-changes-yml.schema.json
2+
3+
- summary: |
4+
Patch the bundled `ip-address` to v10.2.0 in the php-sdk container to
5+
address CVE-2026-42338 / GHSA-v2v4-37r5-5v8g (XSS in `Address6` HTML-
6+
emitting methods). npm 11.12.1 (shipped with `node:24.15`) bundles
7+
`ip-address@10.1.0` via `socks`; this overlays the published 10.2.0
8+
tarball in place at image build time.
9+
type: chore

‎generators/python/sdk/Dockerfile‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,20 @@ RUN for dir in \
4545
fi; \
4646
done
4747

48+
# Patch ip-address to 10.2.0 to fix CVE-2026-42338 / GHSA-v2v4-37r5-5v8g
49+
# (XSS in Address6 HTML-emitting methods). npm bundles ip-address via socks.
50+
RUN for dir in \
51+
/usr/local/lib/node_modules/npm/node_modules/ip-address; do \
52+
if [ -d "$dir" ]; then \
53+
rm -rf "$dir" && \
54+
cd "$(dirname "$dir")" && \
55+
curl -sL https://registry.npmjs.org/ip-address/-/ip-address-10.2.0.tgz -o ip-address-10.2.0.tgz && \
56+
tar -xzf ip-address-10.2.0.tgz && \
57+
mv package ip-address && \
58+
rm ip-address-10.2.0.tgz; \
59+
fi; \
60+
done
61+
4862
# Install ruff.
4963
RUN pip install ruff==0.15.7
5064
RUN ruff --version
@@ -53,6 +67,9 @@ RUN ruff --version
5367
ENV PYTHONPATH=${PYTHONPATH}:${PWD}
5468
ENV _TYPER_STANDARD_TRACEBACK=1
5569

70+
# Upgrade pip to 26.1+ to address CVE-2025-8869, CVE-2026-3219, CVE-2026-6357,
71+
# and CVE-2026-1703 (self-update flaw running after wheel install).
72+
RUN pip3 install --upgrade pip==26.1
5673
# Keep in sync with the poetry-core version in pyproject.toml
5774
RUN pip3 install poetry==1.8.5
5875
RUN poetry config virtualenvs.create false

0 commit comments

Comments
 (0)