chore: upgrade curl to >=8.22.0-r0 to address 18 curl/libcurl CVEs - #1634
Open
claude[bot] wants to merge 2 commits into
Open
chore: upgrade curl to >=8.22.0-r0 to address 18 curl/libcurl CVEs#1634claude[bot] wants to merge 2 commits into
claude[bot] wants to merge 2 commits into
Conversation
Trivy reports the runner image shipping curl/libcurl 8.20.0-r0, which is affected by a large batch of upstream curl security fixes released in 8.21.0/8.22.0. The runner stage already runs `apk upgrade --no-cache`, but that alone can resolve against a cached layer and silently keep the old package. Adding an explicit minimum version makes the floor a build-time requirement. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Contributor
|
@claude[bot] your pull request is missing a changelog! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Trivy reports
curlandlibcurlat8.20.0-r0in the runner image, which is affected by the batch of upstream curl security fixes released in8.21.0/8.22.0. Alpine ships the fixes in8.22.0-r0.The runner stage already ran
apk upgrade --no-cache, but that alone is not a guarantee: theRUNlayer is served from the GitHub Actions buildx cache (cache-from: type=ghain.github/workflows/_build.yml), so an unchanged command can keep resolving to a stale package set. Adding an explicit minimum version turns the patched floor into a build-time requirement, so the image can never silently ship a vulnerablecurl/libcurlagain.libcurlis not installed explicitly. Alpine'scurlpackage depends onlibcurlat the same version, so constrainingcurlpins both.Advisories addressed
Verification — please read before merging
This change has not been build-verified. Two things to be aware of:
curl>=8.22.0-r0could not be resolved locally. The floor is taken from Trivy'sFixedVersion, which comes from Alpine's ownv3.23security database, so the package should be present in the branch.If the pinned version is not yet published for a platform,
apkfails the build loudly rather than silently shipping a vulnerable package. That is the intended behaviour, but it does mean an unverified merge could breakmain's image build.Note for reviewers
A sibling PR raises the
util-linuxfloor on the sameapk addline. The two will conflict textually; whichever merges second needs a trivial rebase.Fixes SOU-2149
Fixes SOU-2150
Fixes SOU-2151
Fixes SOU-2152
Fixes SOU-2153
Fixes SOU-2154
Fixes SOU-2161
Fixes SOU-2162
Fixes SOU-2163
Fixes SOU-2164
Fixes SOU-2165
Fixes SOU-2166
Fixes SOU-2167
Fixes SOU-2168
Fixes SOU-2169
Fixes SOU-2170
Fixes SOU-2171
Fixes SOU-2172
🤖 Generated with Claude Code