Clear Trivy: APT_CACHE_BUST + snyk-broker v1.0.14-axon + drop hard pins#104
Open
ashiramin wants to merge 3 commits into
Open
Clear Trivy: APT_CACHE_BUST + snyk-broker v1.0.14-axon + drop hard pins#104ashiramin wants to merge 3 commits into
ashiramin wants to merge 3 commits into
Conversation
When the scheduled Trivy scan flags OS-package CVEs on :main, the underlying cause is that buildx's layer cache for the apt RUN hashes only on the Dockerfile text — same text → same cached layer → `apt-get update` never re-fetches from the archive even though the RUN explicitly calls it. PRs #99 and #102 worked around this by pinning specific transitive packages (libngtcp2, libnghttp2). The pin invalidated the cache as a side effect of changing Dockerfile text, but locks the build to a single archive version that ages out. PR #99 deferred a cleaner fix; this is that fix. ARG APT_CACHE_BUST is declared right before the apt RUN and referenced inside it. Buildx folds the ARG value into the layer's cache key, so bumping the value (a one-line PR) invalidates only this layer — other layers (Go build, npm install, snyk-broker clone) keep hitting cache as before. Today's value (2026-05-19) also fixes today's failing :main scan: merging this PR is itself an ARG bump, so the apt layer rebuilds, fresh packages land, the next Trivy scan passes.
ashiramin
force-pushed
the
aa/fix-vulns-20260518-221951
branch
from
237498d to
f68be9a
Compare
ashiramin
changed the title
cortexapps/snyk-broker#23 promoted the `engine.io-client.ws` scoped override to a top-level `ws` override so both engine.io and engine.io-client resolve to the patched 8.20.1. The tag v1.0.14-axon carries that change. Verified pre-merge by building a minimal node:20-slim image with the local package files: ws resolves to 8.20.1 in node_modules; trivy image scan no longer reports CVE-2026-45736. Combined with the APT_CACHE_BUST in the prior commit, this clears every finding from today's failing :main Trivy scan (11 OS packages + ws).
ashiramin
changed the title
…lace The pins were added in #99/#102 because the buildx cache was serving stale apt layers — explicit versions invalidated the cache as a side effect and guaranteed the patched packages landed. With APT_CACHE_BUST now driving cache invalidation explicitly, `apt-get upgrade -y` pulls the current patched versions transitively via wget → libcurl3-gnutls, no pin required. Keeping the pins past this point has a cost: they prevent apt from picking up future Debian point releases (e.g. a hypothetical libnghttp2 deb13u2 patch), and they break the build if the pinned version ages out of the archive. Now that the cache mechanism is the actual fix, the pins are redundant belt-on-belt. Validated by the trivy-pr scan on this PR — if removal regresses CVE-2026-40170 or CVE-2026-27135, trivy-pr will flag it before merge.
ashiramin
changed the title
keithfz
approved these changes
May 21, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Clears every finding from the May 18 `:main` Trivy scan — 11 OS-package CVEs + 1 Node-package CVE — removes the cache-staleness root cause that's been recurring since #99, and retires the per-CVE hard pins as redundant.
Changes
docker/Dockerfile: addARG APT_CACHE_BUST=2026-05-19referenced inside the aptRUN. Buildx folds ARG values into the layer cache key, so bumping this value (a one-line PR) invalidates only the apt layer — Go build, npm install, snyk-broker clone keep hitting cache. Future Trivy failures from stale OS packages become a one-line refresh PR.docker/Dockerfile: bumpSNYK_BROKER_VERSION v1.0.13-axon → v1.0.14-axonto pull fix(deps): bump ws to ~8.20.1 (CVE-2026-45736) snyk-broker#23, which top-level-overrides `ws → ~8.20.1` to address CVE-2026-45736.docker/Dockerfile: removelibngtcp2-16,libngtcp2-crypto-gnutls8,libnghttp2-14hard pins. With APT_CACHE_BUST driving cache invalidation explicitly, `apt-get upgrade -y` pulls the current patched versions transitively via wget → libcurl3-gnutls without needing explicit pins. Keeping the pins would also block apt from picking up future point releases and would eventually break the build when those specific versions age out of the archive. The trivy-pr scan on this PR validates that removing them doesn't regress CVE-2026-40170 or CVE-2026-27135.Why this is the right shape (and what we ruled out)
Three approaches were considered for the OS-package side:
Local `docker buildx build --no-cache` (with the previous pinned variant) + `trivy image`: 0 HIGH/CRITICAL fixable findings. After this PR's pin removal, the same outcome is validated by the PR's `trivy-pr` job — see CI results.
Today's findings cleared
Future workflow
When the daily Trivy scan flags fresh OS-package CVEs:
Hard pins become a last-resort tool for the rare case where `apt-get upgrade` doesn't pull a patched version even with a fresh layer (none today).
Test plan
Related
🤖 Generated with Claude Code