Bump grpc to v1.83.1 and x/crypto to v0.56.0; openssl rows clear on rebuild - #272
Merged
Conversation
The dev chart scan 33750416189 reports CVE-2026-84304 (HIGH) against google.golang.org/grpc v1.82.1 in quay.io/stackstate/stackstate-k8s-process-agent. v1.83.1 is the fixed version and is this repository's own direct dependency, not an inherited base-image package, so it is fixable here. The bump is version-only: no transitive module changed, `go mod verify` passes, and `go build -tags "kubelet kubeapiserver linux cri containerd linux_bpf" ./cmd/...` produces exactly the two pre-existing failures that master produces (undefined runtime.Tracer / runtime.RuntimeSecurity in the datadog-agent upstream eBPF compile assets, which the CI prebuild step generates and a bare checkout does not). Unit tests across pkg, config and model pass. The other findings the same scan attributes to this repository are not source work here. CVE-2026-56854 (x/crypto) was already fixed on master by 26dfc04; the scanned tag 3c6ccf0 predates it, so that row clears on the next image build. The openssl family is base-image packages that BCI.dockerfile installs unpinned via zypper update.
…8662 The rebuilt image at 2b2f7f0 reports two unmanaged findings that the dev chart scan 34027081656 could not see, because that scan measured the stale tag 3c6ccf0 at v0.53.0: CVE-2026-56855 [UNKNOWN] pkg:golang/golang.org/x/crypto@v0.55.0 [grype,trivy] CVE-2026-78662 [UNKNOWN] pkg:golang/golang.org/x/crypto@v0.55.0 [grype,trivy] Both are golang.org/x/crypto/ssh channel-deadlock DoS advisories (GO-2026-6355 and GO-2026-6354) whose fixed version is v0.56.0. x/crypto/ssh is not linked here — the only module packages in the command graph are ocsp, pbkdf2 and scrypt — so neither advisory is reachable in this binary. Bumping anyway for the same reason as 26dfc04: a compatible fixed version exists, which is cheaper and more durable than a suppression. Version-only, no transitive module moved. The `// indirect` marker that 2b2f7f0 dropped from this line is restored, because nothing in this repository imports x/crypto directly. The GO-2026-5932 exception's component purl moves with the module. The evaluator keys exceptions on image and vulnerability id, so the bump could not have unmatched it, but a stale purl would misstate which artifact the accepted risk covers. Its expiry is deliberately left alone: GO-2026-5932 has introduced: 0 and no fixed event in any version, so renewing it or replacing it with a vexhub statement is an exception decision, not remediation. CVE ticket: StackVista/cve-reporter#69
ai-collaboration-app
Bot
changed the title
LouisLotter
approved these changes
Sep 6, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Covers the whole live set of findings that dev chart scan 34027081656 attributes to this repository. Two source bumps, and one row set that needs no source change at all.
What this changes
google.golang.org/grpcv1.82.1 -> v1.83.1x/crypto/sshDoS)golang.org/x/cryptov0.55.0 -> v0.56.0Both are version-only; no transitive module moved.
exceptions/GO-2026-5932.yamlhas its component purl moved to v0.56.0 to match — the evaluator keys exceptions on image and vulnerability id, so the bump could not have unmatched it, but a stale purl would misstate which artifact the accepted risk covers.Why the x/crypto commit is here, when the scan says v0.53.0
The scan measured the stale tag
3c6ccf04, which predates #266. Rebuilding at the previous head2b2f7f0dcleared the row the scan reported (CVE-2026-56854, already fixed on master by 26dfc04) and surfaced two rows the chart scan could not see, on both architectures:GO-2026-6355 and GO-2026-6354, both fixed in v0.56.0. Worth knowing while reading this:
mode: informlanded in #265, so those two were reported without failing the build — a green run here is not by itself evidence of a clean image.x/crypto/sshis not linked; the only module packages in the command graph areocsp,pbkdf2andscrypt. Bumping regardless, for the same reason as 26dfc04: a compatible fixed version exists, which is cheaper and more durable than a suppression.The openssl rows need no change here, and the rebuild now clears them
1 HIGH + 27 MEDIUM (9 CVEs across
openssl,openssl-3,libopenssl3) are inherited SLES packages thatBCI.dockerfileinstalls unpinned viazypper update. The build at2b2f7f0dinstalledlibopenssl3/openssl-33.5.0-150700.5.45.2andopenssl3.5.0-150700.3.4.1fromSLE_BCIon both amd64 and arm64 — exactly the fixed versions the scan asks for — and no openssl row survived in the rebuilt image's scan.This makes the blocker premise in cve-reporter#66 stale for this repository: SLE_BCI has synced the 3.5.0 rebase. #66 still owns the estate-wide picture for the other five repositories.
Validation
Read back from the built artifact rather than from
go.mod:go version -mon the packagedprocess-agentbinary confirmsgolang.org/x/crypto v0.56.0andgoogle.golang.org/grpc v1.83.1.go mod verifypasses;rake ci(imports, vet, lint, test, build, openpgp guard) runs in the pinned builder.scripts/verify-openpgp-absent.shpasses with the release tagskubelet kubeapiserver linux cri containerd linux_bpf, keeping the GO-2026-5932 compensating control honest across the bump.Not fixed here — needs a decision this week
exceptions/GO-2026-5932.yamlexpires 2026-09-10. Its expiry is deliberately untouched by this PR: GO-2026-5932 hasintroduced: 0and nofixedevent in any version, so no bump can clear it and renewing it is an exception decision rather than remediation. When it last lapsed it turned master red on its own. Routed to To triage on cve-reporter#27, which is now scoped to that decision alone.Coordination ticket: cve-reporter#69 — the single coordinator for this repository.
Merge order note: #275 also edits
go.sum, so whichever merges second needs a refresh. (The earlier note here pointed at #271, which was closed unmerged.)