From 1390155ca140762f9d634864bcb9c6d732e757cf Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Wed, 7 Oct 2026 04:14:18 +0000 Subject: [PATCH 1/3] chore(main): release 0.44.3 --- .release-please-manifest.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.release-please-manifest.json b/.release-please-manifest.json index 2ee3aafd6..0181e6a52 100644 --- a/.release-please-manifest.json +++ b/.release-please-manifest.json @@ -1,3 +1,3 @@ { - ".": "0.44.2" + ".": "0.44.3" } From bdaf4f449763f86546dd20c302e1f5948b68dc69 Mon Sep 17 00:00:00 2001 From: Jeremy Hatfield Date: Wed, 7 Oct 2026 04:33:53 +0000 Subject: [PATCH 2/3] chore(security): bump CVE-2026-85091 zlib suppression to 1.3.2-r1 Alpine published zlib 1.3.2-r1 on 2026-10-06 and the runtime stage's apk upgrade now pulls it, so the version-pinned grype suppression for 1.3.2-r0 stopped matching and Supply Chain Verification failed on main / release PR #1504. grype still reports no fix for the CVE; risk acceptance and 2026-10-18 expiry are unchanged. Co-Authored-By: Claude Sonnet 5.5 --- .grype.yaml | 11 ++++++----- .trivyignore | 2 +- 2 files changed, 7 insertions(+), 6 deletions(-) diff --git a/.grype.yaml b/.grype.yaml index dc42b44da..d2b8f0842 100644 --- a/.grype.yaml +++ b/.grype.yaml @@ -1362,7 +1362,8 @@ ignore: # CVE-2026-85091: zlib gz_vacate() heap buffer overflow via stale gzwrite() buffer pointers (DoS) # Severity: HIGH (CVSS 8.3 v4.0 / 7.4 v3.1) - # Package: zlib 1.3.2-r0 (Alpine apk base image) + # Package: zlib 1.3.2-r1 (Alpine apk base image; bumped from 1.3.2-r0 on 2026-10-07 when Alpine + # published -r1 on 2026-10-06. grype still reports no fix, so the pin must follow the shipped version) # Status: No upstream fix available — grype reports fix.versions: [] / fix.state: "" as of 2026-09-18 # # Vulnerability Details: @@ -1373,7 +1374,7 @@ ignore: # # Root Cause (No Fix Available): # - grype's NVD-sourced advisory records no fixed version for CVE-2026-85091 as of 2026-09-18. - # - Alpine's zlib package tracker has not yet published a patched build past 1.3.2-r0. + # - Alpine's zlib package tracker has not yet published a patched build past 1.3.2-r1. # - Fix path: once Alpine (or upstream zlib) ships a patched package, rebuild the Docker image # and remove this suppression. # @@ -1385,7 +1386,7 @@ ignore: # - Container-level isolation reduces the attack surface further. # # Mitigation (active while suppression is in effect): - # - Monitor Alpine's zlib package tracker for a patched build past 1.3.2-r0. + # - Monitor Alpine's zlib package tracker for a patched build past 1.3.2-r1. # - Weekly CI security rebuild (security-weekly-rebuild.yml) flags any new CVEs in the full image. # # Review: @@ -1405,11 +1406,11 @@ ignore: - vulnerability: CVE-2026-85091 package: name: zlib - version: "1.3.2-r0" + version: "1.3.2-r1" type: apk reason: | HIGH — zlib gz_vacate() heap buffer overflow via stale gzwrite() buffer pointers (DoS) in - zlib 1.3.2-r0 (Alpine base image). No upstream fix: grype reports fix.versions empty as of + zlib 1.3.2-r1 (Alpine base image). No upstream fix: grype reports fix.versions empty as of 2026-09-18. Charon's Go backend uses compress/gzip and compress/flate, not zlib directly; zlib is present only as an Alpine system-library dependency. Risk accepted pending an Alpine/upstream patch. diff --git a/.trivyignore b/.trivyignore index 24beef552..b793c00f0 100644 --- a/.trivyignore +++ b/.trivyignore @@ -313,7 +313,7 @@ CVE-2026-81871 GHSA-w34q-cm8f-9c5x # CVE-2026-85091: zlib gz_vacate() heap buffer overflow via stale gzwrite() buffer pointers (DoS) -# Severity: HIGH (CVSS 8.3 v4.0 / 7.4 v3.1) — Package: zlib 1.3.2-r0 in Alpine base image +# Severity: HIGH (CVSS 8.3 v4.0 / 7.4 v3.1) — Package: zlib 1.3.2-r1 in Alpine base image (was -r0; grype reports no fix for -r1) # No upstream fix available: grype reports fix.versions empty as of 2026-09-18. Charon's Go # backend uses compress/gzip and compress/flate, not zlib directly; zlib is present only as an # Alpine system-library dependency. Risk accepted pending an Alpine/upstream patch. From cc7ccc01106cd8f845f163a0036d16e4881592ff Mon Sep 17 00:00:00 2001 From: Jeremy Hatfield Date: Wed, 7 Oct 2026 04:55:23 +0000 Subject: [PATCH 3/3] chore: revert comment-only .trivyignore edit to keep toolchain pin fresh The toolchain key hashes .trivyignore byte for byte, so the comment-only change from the previous commit moved the key and left the Dockerfile pin stale. The functional zlib version bump in .grype.yaml is unchanged. Tracked in #1505. --- .trivyignore | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.trivyignore b/.trivyignore index b793c00f0..24beef552 100644 --- a/.trivyignore +++ b/.trivyignore @@ -313,7 +313,7 @@ CVE-2026-81871 GHSA-w34q-cm8f-9c5x # CVE-2026-85091: zlib gz_vacate() heap buffer overflow via stale gzwrite() buffer pointers (DoS) -# Severity: HIGH (CVSS 8.3 v4.0 / 7.4 v3.1) — Package: zlib 1.3.2-r1 in Alpine base image (was -r0; grype reports no fix for -r1) +# Severity: HIGH (CVSS 8.3 v4.0 / 7.4 v3.1) — Package: zlib 1.3.2-r0 in Alpine base image # No upstream fix available: grype reports fix.versions empty as of 2026-09-18. Charon's Go # backend uses compress/gzip and compress/flate, not zlib directly; zlib is present only as an # Alpine system-library dependency. Risk accepted pending an Alpine/upstream patch.