mirror of
https://github.com/Studio-Saelix/sencho.git
synced 2026-08-12 19:57:37 +00:00
Anso
6b8c369745
* fix(notifications): stop Sencho version notifications from silently skipping Three independent defects combined to make version-update notifications silently fail even while Fleet overview correctly surfaced an update button: - The in-memory 6-hour cooldown was advanced before the network fetch, so a single transient failure at boot could lock the check for the rest of the container lifetime. Moved the cooldown update inside the success branch so failures retry on the next eval cycle. - MonitorService called the raw version fetch directly, bypassing the CacheService wrapper (TTL, inflight dedup, stale-on-error) that Fleet uses, so the two paths could diverge. Unified both on a shared getLatestVersion() helper in utils/version-check.ts. - The dedup key could carry stale state from a previous build and never self-clear. It now self-heals when the running version reaches the previously-notified version, so future releases re-fire as expected. Added diagnostic logs gated on debug mode for each skip branch, plus three regression tests covering cooldown-on-failure, cooldown-on-success, and dedup self-heal. * docs(notifications): drop legacy-upgrade framing from alerts troubleshooting Sencho has not shipped publicly, so troubleshooting entries written in 'this used to happen but now does Y' mode reference a past that does not exist for any reader. Rewrote the version-notification, image-update, and crash-alert troubleshooting entries to describe current behavior positively without referring to prior builds, upgrade paths, or legacy fixes. * chore(security): accept CVE-2026-33810 in bundled Docker CLI 29.4.0 Trivy now flags CVE-2026-33810 (Go stdlib crypto/x509 DNS constraint bypass, fixed in Go 1.26.2) in the Docker CLI static binary we ship. Docker CLI 29.4.0 is the latest upstream release and still links Go 1.26.1; no newer static binary exists yet. Same exposure profile as the already-accepted CVE-2026-32280: the Docker CLI and compose plugin only validate certificates from well-known registry CAs and the local Docker socket, not from attacker-controlled CAs with crafted DNS name constraints. Revisit on the next Docker CLI release that rebuilds against Go 1.26.2 or later.
119 lines
6.0 KiB
Plaintext
119 lines
6.0 KiB
Plaintext
# Trivy ignore list
|
|
#
|
|
# Every entry in this file is a known HIGH or CRITICAL CVE that we have
|
|
# consciously accepted risk on and decided not to block CI over. Format:
|
|
#
|
|
# CVE-YYYY-NNNNN
|
|
# # Justification: why we're accepting this risk, and a link or note about
|
|
# # when to revisit (e.g. "blocked on upstream base image update, revisit
|
|
# # when alpine/node:22 ships a fix").
|
|
#
|
|
# Rules:
|
|
# - Every CVE MUST have a justification comment directly above it.
|
|
# - If there is no justification, the CVE is not ignored - add it here only
|
|
# after a human review and a decision to accept the risk.
|
|
# - Review this file on every release; remove entries whose upstream fix has
|
|
# landed.
|
|
#
|
|
# Picked up automatically by aquasecurity/trivy-action from the repo root
|
|
# working directory. Both the pre-push PR scan (.github/workflows/ci.yml) and
|
|
# the release-time re-scan (.github/workflows/docker-publish.yml) honor it.
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Bundled inside /usr/local/bin/docker and docker-compose
|
|
# ---------------------------------------------------------------------------
|
|
# Docker CLI 29.4.0 ships Go 1.26.1 and Compose v5.1.2 ships Go 1.25.8.
|
|
# Both Go versions are vulnerable (fix requires Go 1.25.9 or 1.26.2).
|
|
# No upstream static binary ships a patched Go runtime yet. Revisit on the
|
|
# next Docker CLI and Compose release.
|
|
|
|
# Justification: Go stdlib symlink-following in Root.Chmod. Sencho does not
|
|
# use Root.Chmod; the Docker CLI and compose plugin are invoked as
|
|
# subprocesses to manage containers. The vulnerable code path requires a
|
|
# chroot context with attacker-controlled filesystem, which does not apply
|
|
# to our usage. Blocked on upstream Go rebuild; revisit on next CLI/Compose
|
|
# release.
|
|
CVE-2026-32282
|
|
|
|
# Justification: Go stdlib crypto/x509 certificate chain building DoS.
|
|
# Affects the same Go 1.26.1 (CLI) and 1.25.8 (Compose) runtimes as above.
|
|
# The Docker CLI and compose plugin do not perform x509 chain validation
|
|
# against untrusted certificates in our usage (they connect to the local
|
|
# Docker socket or to registries with well-known CAs). Blocked on upstream
|
|
# Go rebuild; revisit on next CLI/Compose release.
|
|
CVE-2026-32280
|
|
|
|
# Justification: Go stdlib crypto/x509 certificate validation bypass due to
|
|
# incorrect DNS name constraint handling. Fixed in Go 1.26.2, but Docker CLI
|
|
# 29.4.0 ships Go 1.26.1 and no newer upstream static binary is available.
|
|
# Same exposure profile as CVE-2026-32280: the Docker CLI and compose plugin
|
|
# only validate certificates from well-known registry CAs and the local
|
|
# Docker socket in our usage, not from attacker-controlled CAs with crafted
|
|
# DNS name constraints. Blocked on upstream Go rebuild; revisit on next
|
|
# CLI/Compose release.
|
|
CVE-2026-33810
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Bundled inside /usr/local/lib/docker/cli-plugins/docker-compose (v5.1.2)
|
|
# ---------------------------------------------------------------------------
|
|
# Compose v5.1.2 is the latest upstream release. It statically links older
|
|
# copies of github.com/docker/docker, buildkit, and otel. We cannot bump
|
|
# these transitively without waiting for a new upstream Compose release.
|
|
# Revisit this block on every Compose release; remove entries as upstream
|
|
# rebuilds ship the fixes.
|
|
|
|
# Justification: github.com/docker/docker v28.5.2 statically bundled in
|
|
# compose v5.1.2. Moby authz bypass applies to a Docker daemon, not to the
|
|
# compose CLI plugin; compose never runs as a daemon. Revisit on next
|
|
# Compose upstream release.
|
|
CVE-2026-34040
|
|
|
|
# Justification: github.com/moby/buildkit v0.27.1 statically bundled in
|
|
# compose v5.1.2. BuildKit arbitrary file write via untrusted frontend is
|
|
# exploited at buildkit build time with attacker-controlled frontends; our
|
|
# compose invocations only call up/down/ps against local user-authored
|
|
# compose files, never as a build frontend. Revisit on next Compose upstream
|
|
# release.
|
|
CVE-2026-33747
|
|
|
|
# Justification: github.com/moby/buildkit v0.27.1 statically bundled in
|
|
# compose v5.1.2. Same exposure profile as CVE-2026-33747 (Git URL fragment
|
|
# subdir exploitation requires invoking buildkit on untrusted repo URLs,
|
|
# which compose does not do in our flow). Revisit on next Compose upstream
|
|
# release.
|
|
CVE-2026-33748
|
|
|
|
# Justification: go.opentelemetry.io/otel/sdk v1.38.0 statically bundled in
|
|
# compose v5.1.2. PATH hijacking requires the attacker to control the
|
|
# process PATH before compose starts; our container starts compose from a
|
|
# fixed PATH with only /usr/local/bin and /usr/bin on it, both owned by
|
|
# root. Revisit on next Compose upstream release.
|
|
CVE-2026-24051
|
|
|
|
# Justification: go.opentelemetry.io/otel/sdk v1.38.0 statically bundled in
|
|
# compose v5.1.2. BSD kenv PATH hijacking only applies on BSD systems; we
|
|
# ship linux/amd64 and linux/arm64. Not applicable in our runtime. Revisit
|
|
# on next Compose upstream release.
|
|
CVE-2026-39883
|
|
|
|
# Justification: google.golang.org/grpc v1.78.0 statically bundled in
|
|
# Docker CLI v29.4.0. Compose v5.1.2 bumped grpc to 1.80.0, resolving this
|
|
# for the compose binary. The CLI still ships 1.78.0. Exploit requires an
|
|
# attacker-controlled HTTP/2 peer talking to a gRPC server; the docker CLI
|
|
# only acts as a gRPC client against the local unix socket, not as a server.
|
|
# Revisit on next Docker CLI release.
|
|
CVE-2026-33186
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Bundled inside /usr/local/lib/node_modules/npm/ (node:22-alpine base image)
|
|
# ---------------------------------------------------------------------------
|
|
|
|
# Justification: picomatch 4.0.3 is shipped inside the npm CLI that comes
|
|
# bundled with the upstream node:22-alpine base image. We do not run npm at
|
|
# container runtime against user-controlled input; npm is only invoked at
|
|
# build time against our own package.json files. The ReDoS requires an
|
|
# attacker-authored extglob pattern, which is not reachable from any
|
|
# runtime code path. Revisit when a future node:22-alpine base image ships
|
|
# a newer npm that bundles picomatch >= 4.0.4.
|
|
CVE-2026-33671
|