mirror of
https://github.com/Studio-Saelix/sencho.git
synced 2026-10-25 05:00:25 +00:00
Anso
57e2d98a62
* fix(docker): rebuild the Compose plugin from v5.6.0 The source-built Compose plugin moves from tag v5.1.3 to v5.6.0 (commit 42f48072). Its own go.mod resolves the module floors this stage used to carry by hand, otel/sdk v1.46.0, google.golang.org/grpc v1.84.0, moby/go-archive v0.3.3, moby/buildkit v0.33.1, and containerd/containerd/v2 v2.4.1, so the explicit go get list shrinks from twelve entries to three: golang.org/x/net v0.60.0, x/text v0.42.0, and x/crypto v0.57.0, which this tag still resolves below their fixed versions. The bump clears the two MEDIUM findings that remained in that binary (buildkit, and sigstore-go which this graph no longer contains) and drops github.com/docker/docker from the graph altogether. Five VEX statements that triaged docker/docker v28.5.2 as not_affected describe a module the built binary no longer links, and the in-toto-golang statement becomes a status: fixed record because v5.6.0 pulls v0.11.0, the version it was waiting for. Verified: the stage builds and the rebuilt plugin scans clean at MEDIUM and above against the database CI uses; its command surface, config and ps output shapes, and build fallback behavior match the previous tag on the same inputs; and a full compose lifecycle through the shipped CLI succeeds on a scratch stack. * chore(vex): name the shipped in-toto version in the resolution record An OpenVEX fixed statement describes the product version that carries the fix, so the statement for GHSA-pmwq-pjrm-6p5r now names github.com/in-toto/in-toto-golang v0.11.0 rather than the v0.10.0 build the Compose v5.6.0 tag replaced. The status note still records the version it supersedes.
41 lines
2.6 KiB
JSON
41 lines
2.6 KiB
JSON
{
|
|
"@context": "https://openvex.dev/ns/v0.2.0",
|
|
"@id": "https://github.com/studio-saelix/sencho/security/vex/sencho.openvex.json",
|
|
"author": "Studio Saelix",
|
|
"role": "Vendor",
|
|
"timestamp": "2026-05-18T00:00:00Z",
|
|
"last_updated": "2026-10-16T00:00:00Z",
|
|
"version": 10,
|
|
"statements": [
|
|
{
|
|
"vulnerability": {
|
|
"@id": "https://github.com/advisories/GHSA-pmwq-pjrm-6p5r",
|
|
"name": "GHSA-pmwq-pjrm-6p5r",
|
|
"description": "in-toto-golang and in-toto-python use inconsistent negation operators in artifact rule glob patterns"
|
|
},
|
|
"products": [
|
|
{
|
|
"@id": "pkg:golang/github.com/in-toto/in-toto-golang@v0.11.0"
|
|
}
|
|
],
|
|
"status": "fixed",
|
|
"status_notes": "Fixed upstream rather than triaged. docker/compose v5.6.0 resolves github.com/in-toto/in-toto-golang v0.11.0, the release that aligns the glob-negation operators in artifact rule patterns, and the source-built Compose plugin embeds that version, so the v0.10.0 build this statement used to cover is no longer shipped. The product below is the version the image carries now, and this statement records the resolution rather than suppressing a finding."
|
|
},
|
|
{
|
|
"vulnerability": {
|
|
"@id": "https://github.com/advisories/GHSA-vfj7-8cjw-p6xm",
|
|
"name": "CVE-2026-93687",
|
|
"description": "braces is vulnerable to stack-exhaustion denial of service through deeply nested glob patterns (GHSA-vfj7-8cjw-p6xm)"
|
|
},
|
|
"products": [
|
|
{
|
|
"@id": "pkg:npm/braces@3.0.3"
|
|
}
|
|
],
|
|
"status": "not_affected",
|
|
"justification": "vulnerable_code_cannot_be_controlled_by_adversary",
|
|
"impact_statement": "braces 3.0.3 can exhaust the stack while parsing a deeply nested glob pattern, so exploitation requires an adversary to control the pattern text that braces compiles. In Sencho, braces enters the production image through micromatch, which http-proxy-middleware uses to compile the proxy context and path-filter patterns once at startup from static configuration; request URLs are matched against the compiled matcher and are never compiled as patterns. The remaining occurrences are development-time watchers (chokidar under nodemon and the TypeScript watcher) watching fixed paths. No request-controlled input reaches the braces parser, so the vulnerable code cannot be triggered by a remote adversary. No patched release exists: 3.0.3 is the newest published version and the advisory lists no fixed version, so the dependency audit gate honors this statement instead of blocking every change."
|
|
}
|
|
]
|
|
}
|