fix(seed): remediate 35 csharp-seed container CVEs#15735
Conversation
Patch the OS packages flagged by the 2026-05-06 grype scan against the
csharp-seed container (curl, libcurl3t64-gnutls, libcurl4t64,
libnghttp2-14, libcap2, sed) by upgrading them in the image layer.
Bump and pin the cached NuGet packages to non-vulnerable versions:
Portable.System.DateTimeOnly 8.0.2 -> 9.0.1
System.Text.Json 8.0.5 -> 10.0.5
Microsoft.Extensions.Logging.Abstractions 8.0.2 -> 10.0.0
Add explicit overrides so the vulnerable transitive versions of the
following are evicted from the warmed cache:
Microsoft.AspNetCore.Http -> 2.3.9
(GHSA-hxrm-9w7p-39cc)
Microsoft.AspNetCore.Server.Kestrel.Core -> 2.3.8
(GHSA-5rrx-jjjq-q2r5 / CVE-2025-55315)
OpenTelemetry / OpenTelemetry.Api /
OpenTelemetry.Exporter.OpenTelemetryProtocol -> 1.15.3
(GHSA-q834-8qmm-v933, GHSA-g94r-2vxg-569j, GHSA-mr8r-92fq-pj8p,
GHSA-4625-4j76-fww9)
System.Text.Encodings.Web -> 10.0.5
(GHSA-ghhp-997w-qr28; the 4.7.2 nupkg's netstandard1.0 fallback
DLL still ships FileVersion 4.6.29812.01 and grype reads it)
System.Formats.Asn1 -> 10.0.5
(GHSA-447r-wph3-92pm)
The System.Net.Http >= 4.3.4 floor and existing System.Security.
Cryptography.Xml resolution already resolve the remaining advisories
from the original scan.
Delete the grype scan scaffold file once remediation is in place.
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
Claude Code Review
This repository is configured for manual code reviews. Comment @claude review to trigger a review and subscribe this PR to future pushes, or @claude review once for a one-time review.
Tip: disable this comment in your organization's Code Review settings.
devin-ai-integration
Bot
changed the title
SDK Generation Benchmark ResultsComparing PR branch against median of 5 nightly run(s) on Full benchmark table (click to expand)
main (generator): generator-only time via --skip-scripts (includes Docker image build, container startup, IR parsing, and code generation — this is the same Docker-based flow customers use via |
1 participant
Description
Linear ticket: Refs grype scan 2026-05-06 for
csharp-seedRemediates the 35 vulnerabilities (3 Critical, 4 High, 19 Medium, 9 Low) reported by the 2026-05-06 grype scan against the
csharp-seedDocker container.The container is
docker/seed/Dockerfile.csharp— used by seed tests for the C# generator, not the publishedcsharp-sdkgenerator itself, so no generator changelog entry is required.Changes Made
OS-level (apt) — added an
apt-get install --only-upgradelayer to pull patched debs fromnoble-updates:curl,libcurl3t64-gnutls,libcurl4t64→8.5.0-2ubuntu10.9(CVE-2026-{5545,6253,6429,7168,4873,5773,6276})libnghttp2-14→1.59.0-1ubuntu0.3(CVE-2026-27135)libcap2→1:2.66-5ubuntu2.4(CVE-2026-4878)sed→4.9-2ubuntu0.24.04.1(CVE-2026-5958)NuGet — pin bumps to fixed versions:
Portable.System.DateTimeOnly8.0.2 → 9.0.1(matches what generated SDKs use)System.Text.Json8.0.5 → 10.0.5(also fixes a pre-existing transitive downgrade vs WireMock.Net's Scriban dependency)Microsoft.Extensions.Logging.Abstractions8.0.2 → 10.0.0(also fixes a transitive downgrade vs OpenTelemetry / Grpc.Net.ClientFactory)NuGet — explicit overrides (evict vulnerable transitive versions from the warmed cache):
Microsoft.AspNetCore.Http→2.3.9(GHSA-hxrm-9w7p-39cc)Microsoft.AspNetCore.Server.Kestrel.Core→2.3.8(GHSA-5rrx-jjjq-q2r5 / CVE-2025-55315)OpenTelemetry/OpenTelemetry.Api/OpenTelemetry.Exporter.OpenTelemetryProtocol→1.15.3(GHSA-q834-8qmm-v933, GHSA-g94r-2vxg-569j, GHSA-mr8r-92fq-pj8p, GHSA-4625-4j76-fww9)System.Text.Encodings.Web→10.0.5(GHSA-ghhp-997w-qr28; without this, the4.7.2nupkg is still pulled transitively and itsnetstandard1.0fallback DLL hasFileVersion 4.6.29812.01, which grype keeps reporting)System.Formats.Asn1→10.0.5(GHSA-447r-wph3-92pm)The existing
System.Net.Http [4.3.4,)constraint and the resolution ofSystem.Security.Cryptography.Xmlalready cover the remaining advisories from the original scan.Also deleted the
.github/grype-scans/scan-csharp-seed-20260506.mdscaffold file.Testing
Built locally and re-scanned with grype:
After the fix, all 35 dotnet + OS findings reported in the original scan are gone. The remaining entries grype shows locally are OS CVEs that have no
FIXED-INentry in the Ubuntu repos yet (i.e. nothing to upgrade to) and were not part of the original 35-vuln scan since the scanner only reports findings withStatus: fixed.cc @davidkonigsberg
Link to Devin session: https://app.devin.ai/sessions/45bde98fe8aa4250bc7b18727caed287