Anso c67478b50d chore(security): VEX three new compose CVE findings and correct dependency comment (#1201) ...

Trivy reported three new advisories against the compose binary today:

- CVE-2026-41568 (docker cp symlink-swap empty-file creation, sibling of
  CVE-2026-42306)
- CVE-2026-33997 (Moby plugin install privilege bypass)
- GHSA-pmwq-pjrm-6p5r (in-toto-golang glob-negation operator mismatch)

All three are daemon-side or supply-chain attestation code paths that
compose only embeds as client-side libraries. Sencho invokes compose
exclusively for up/down/ps against user-authored compose files, never
runs daemon endpoints, never performs plugin installation, and never
verifies in-toto attestations. Each gets a not_affected statement with
a full impact rationale; bump version 7 to 8 and last_updated to today.

Also correct the compose-builder comment in Dockerfile. The previous
text claimed compose v5.1.3 "eliminated CVE-2026-34040 and CVE-2026-33997
at the dependency level" by moving docker/docker to an indirect dep.
That is wrong: the module is still pulled via buildkit and other
transitive paths, the CVEs still appear in scans, and they are tracked
in the VEX file rather than eliminated. The corrected comment points
the reader at the VEX file as the source of truth for these findings.

2026-05-24 18:30:39 -04:00

..

vex

chore(security): VEX three new compose CVE findings and correct dependency comment (#1201)

2026-05-24 18:30:39 -04:00