Anso 0951a0e792 chore(deps): bump containerd to v2.2.4 to clear CVE-2026-46680 (#1199) ...

The compose-builder stage now pulls containerd/v2 v2.2.4 alongside the
existing otel security bumps. containerd v2.2.3 (the version pinned by
docker/compose v5.1.3) carries CVE-2026-46680, a runAsNonRoot evasion in
the runtime executor; v2.2.4 is the upstream patch release that fixes
it. The vulnerable code path is daemon-side and was never reachable from
compose, but bumping at the dependency level removes the entry from the
SBOM rather than relying on a VEX suppression.

Removed the corresponding statement from security/vex/sencho.openvex.json
and bumped version + last_updated.

The remaining three statements (docker/docker daemon CVEs) stay
suppressed: the fix lives on a new github.com/moby/moby/v2 module path,
and compose has not migrated imports yet, so no resolvable version bump
clears them.

2026-05-24 18:22:27 -04:00

..

sencho.openvex.json

chore(deps): bump containerd to v2.2.4 to clear CVE-2026-46680 (#1199)

2026-05-24 18:22:27 -04:00