mirror of
https://github.com/Studio-Saelix/sencho.git
synced 2026-08-30 20:29:15 +00:00
Anso
a17b16b258
* fix(scheduler): harden auto-update policies with cascade deletes, error reporting, and UI fixes
- Fix orphaned task runs on policy/node deletion with transaction-wrapped cascade deletes
- Make manual trigger non-blocking (202 Accepted) to prevent proxy timeouts
- Distinguish registry check failures from clean "no update" results via structured ImageCheckResult
- Trim whitespace-only policy names in both frontend and backend validation
- Add strokeWidth={1.5} to action icons per design system
- Add sr-only DialogDescription for Radix accessibility
- Replace Select with Combobox for frequency picker
- Wrap run history sheet content in ScrollArea
- Support concurrent Run Now indicators via Set-based state
- Abort stale stack fetches on node switch with AbortController
- Add standard and diagnostic logging to SchedulerService and ImageUpdateService
- Add tests for cascade deletes, image checking, and scheduler edge cases
- Add troubleshooting section to auto-update docs
* fix(tests): resolve lint errors in image-update-service tests
Remove unused mock variables (mockGetImage, mockGetDocker) and unused
ImageCheckResult type import. Replace CommonJS require('yaml') with
ESM import to satisfy no-require-imports rule.
* chore(deps): bump Docker CLI to 29.4.0 and Compose to v5.1.2
Resolves Trivy CVE-2026-32282 (Go stdlib symlink follow in Root.Chmod)
by upgrading to releases that ship Go 1.25.9. Compose v5.1.2 also bumps
grpc to 1.80.0, resolving CVE-2026-33186.
* chore(security): accept CVE-2026-32282 in .trivyignore, update stale refs
Go stdlib symlink-following in Root.Chmod (CVE-2026-32282) affects both
Docker CLI 29.4.0 (Go 1.26.1) and Compose v5.1.2 (Go 1.25.8). Fix
requires Go 1.25.9 or 1.26.2; no upstream static binary ships a patched
runtime yet. The vulnerable code path requires a chroot context with
attacker-controlled filesystem, which does not apply to our usage.
Also updates version references from v5.1.1/v29.3.1 to v5.1.2/v29.4.0
for existing CVE entries, and notes that Compose v5.1.2 resolved
CVE-2026-33186 (grpc bumped to 1.80.0) for the compose binary.
101 lines
5.0 KiB
Plaintext
101 lines
5.0 KiB
Plaintext
# Trivy ignore list
|
|
#
|
|
# Every entry in this file is a known HIGH or CRITICAL CVE that we have
|
|
# consciously accepted risk on and decided not to block CI over. Format:
|
|
#
|
|
# CVE-YYYY-NNNNN
|
|
# # Justification: why we're accepting this risk, and a link or note about
|
|
# # when to revisit (e.g. "blocked on upstream base image update, revisit
|
|
# # when alpine/node:22 ships a fix").
|
|
#
|
|
# Rules:
|
|
# - Every CVE MUST have a justification comment directly above it.
|
|
# - If there is no justification, the CVE is not ignored - add it here only
|
|
# after a human review and a decision to accept the risk.
|
|
# - Review this file on every release; remove entries whose upstream fix has
|
|
# landed.
|
|
#
|
|
# Picked up automatically by aquasecurity/trivy-action from the repo root
|
|
# working directory. Both the pre-push PR scan (.github/workflows/ci.yml) and
|
|
# the release-time re-scan (.github/workflows/docker-publish.yml) honor it.
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Bundled inside /usr/local/bin/docker and docker-compose
|
|
# ---------------------------------------------------------------------------
|
|
# Docker CLI 29.4.0 ships Go 1.26.1 and Compose v5.1.2 ships Go 1.25.8.
|
|
# Both are vulnerable to CVE-2026-32282 (fix requires Go 1.25.9 or 1.26.2).
|
|
# No upstream static binary ships a patched Go runtime yet. Revisit on the
|
|
# next Docker CLI and Compose release.
|
|
|
|
# Justification: Go stdlib symlink-following in Root.Chmod. Sencho does not
|
|
# use Root.Chmod; the Docker CLI and compose plugin are invoked as
|
|
# subprocesses to manage containers. The vulnerable code path requires a
|
|
# chroot context with attacker-controlled filesystem, which does not apply
|
|
# to our usage. Blocked on upstream Go rebuild; revisit on next CLI/Compose
|
|
# release.
|
|
CVE-2026-32282
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Bundled inside /usr/local/lib/docker/cli-plugins/docker-compose (v5.1.2)
|
|
# ---------------------------------------------------------------------------
|
|
# Compose v5.1.2 is the latest upstream release. It statically links older
|
|
# copies of github.com/docker/docker, buildkit, and otel. We cannot bump
|
|
# these transitively without waiting for a new upstream Compose release.
|
|
# Revisit this block on every Compose release; remove entries as upstream
|
|
# rebuilds ship the fixes.
|
|
|
|
# Justification: github.com/docker/docker v28.5.2 statically bundled in
|
|
# compose v5.1.2. Moby authz bypass applies to a Docker daemon, not to the
|
|
# compose CLI plugin; compose never runs as a daemon. Revisit on next
|
|
# Compose upstream release.
|
|
CVE-2026-34040
|
|
|
|
# Justification: github.com/moby/buildkit v0.27.1 statically bundled in
|
|
# compose v5.1.2. BuildKit arbitrary file write via untrusted frontend is
|
|
# exploited at buildkit build time with attacker-controlled frontends; our
|
|
# compose invocations only call up/down/ps against local user-authored
|
|
# compose files, never as a build frontend. Revisit on next Compose upstream
|
|
# release.
|
|
CVE-2026-33747
|
|
|
|
# Justification: github.com/moby/buildkit v0.27.1 statically bundled in
|
|
# compose v5.1.2. Same exposure profile as CVE-2026-33747 (Git URL fragment
|
|
# subdir exploitation requires invoking buildkit on untrusted repo URLs,
|
|
# which compose does not do in our flow). Revisit on next Compose upstream
|
|
# release.
|
|
CVE-2026-33748
|
|
|
|
# Justification: go.opentelemetry.io/otel/sdk v1.38.0 statically bundled in
|
|
# compose v5.1.2. PATH hijacking requires the attacker to control the
|
|
# process PATH before compose starts; our container starts compose from a
|
|
# fixed PATH with only /usr/local/bin and /usr/bin on it, both owned by
|
|
# root. Revisit on next Compose upstream release.
|
|
CVE-2026-24051
|
|
|
|
# Justification: go.opentelemetry.io/otel/sdk v1.38.0 statically bundled in
|
|
# compose v5.1.2. BSD kenv PATH hijacking only applies on BSD systems; we
|
|
# ship linux/amd64 and linux/arm64. Not applicable in our runtime. Revisit
|
|
# on next Compose upstream release.
|
|
CVE-2026-39883
|
|
|
|
# Justification: google.golang.org/grpc v1.78.0 statically bundled in
|
|
# Docker CLI v29.4.0. Compose v5.1.2 bumped grpc to 1.80.0, resolving this
|
|
# for the compose binary. The CLI still ships 1.78.0. Exploit requires an
|
|
# attacker-controlled HTTP/2 peer talking to a gRPC server; the docker CLI
|
|
# only acts as a gRPC client against the local unix socket, not as a server.
|
|
# Revisit on next Docker CLI release.
|
|
CVE-2026-33186
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Bundled inside /usr/local/lib/node_modules/npm/ (node:22-alpine base image)
|
|
# ---------------------------------------------------------------------------
|
|
|
|
# Justification: picomatch 4.0.3 is shipped inside the npm CLI that comes
|
|
# bundled with the upstream node:22-alpine base image. We do not run npm at
|
|
# container runtime against user-controlled input; npm is only invoked at
|
|
# build time against our own package.json files. The ReDoS requires an
|
|
# attacker-authored extglob pattern, which is not reachable from any
|
|
# runtime code path. Revisit when a future node:22-alpine base image ships
|
|
# a newer npm that bundles picomatch >= 4.0.4.
|
|
CVE-2026-33671
|