From 0af35b517aa342beadaea0383fb193366ea3b62c Mon Sep 17 00:00:00 2001 From: Antoine Toussaint <312536060+antoinetoussaint-byte@users.noreply.github.com> Date: Wed, 21 Oct 2026 15:32:48 -0400 Subject: [PATCH 1/4] fix(runtime-image): rebuild vault with klauspost/compress v1.18.7 (patched.14) CVE-2026-63209 (HIGH): klauspost/compress 1.18.5 in the vault 2.0.3 build; fixed in 1.18.7. Pinned in the image build like the other patched modules, asserted, and the pin in main.go follows the published digest. Co-Authored-By: Claude Fable 5.1 --- Dockerfile.runtime | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/Dockerfile.runtime b/Dockerfile.runtime index 929f66a..d388ca1 100644 --- a/Dockerfile.runtime +++ b/Dockerfile.runtime @@ -28,12 +28,13 @@ RUN apk add --no-cache bash git COPY --from=ui /src /src WORKDIR /src RUN --mount=type=cache,target=/go/pkg/mod \ - go get google.golang.org/grpc@v1.83.2 github.com/apache/thrift@v0.24.0 golang.org/x/crypto@v0.57.0 golang.org/x/text@v0.42.0 golang.org/x/net@v0.60.0 \ + go get google.golang.org/grpc@v1.83.2 github.com/apache/thrift@v0.24.0 golang.org/x/crypto@v0.57.0 golang.org/x/text@v0.42.0 golang.org/x/net@v0.60.0 github.com/klauspost/compress@v1.18.7 \ && go mod download \ && test "$(go list -m -f '{{.Version}}' google.golang.org/grpc)" = "v1.83.2" \ && test "$(go list -m -f '{{.Version}}' github.com/apache/thrift)" = "v0.24.0" \ && test "$(go list -m -f '{{.Version}}' golang.org/x/crypto)" = "v0.57.0" \ && test "$(go list -m -f '{{.Version}}' golang.org/x/text)" = "v0.42.0" \ + && test "$(go list -m -f '{{.Version}}' github.com/klauspost/compress)" = "v1.18.7" \ && test "$(go list -m -f '{{.Version}}' golang.org/x/net)" = "v0.60.0" ARG TARGETARCH ARG TARGETOS From 1badbacc020f84eea2c651b244c7cdeab5d72fc2 Mon Sep 17 00:00:00 2001 From: Antoine Toussaint <312536060+antoinetoussaint-byte@users.noreply.github.com> Date: Wed, 21 Oct 2026 15:58:23 -0400 Subject: [PATCH 2/4] =?UTF-8?q?fix(runtime-image):=20build=20vault=20with?= =?UTF-8?q?=20Go=201.26.10=20=E2=80=94=20CVE-2026-111943=20in=20the=201.26?= =?UTF-8?q?.9=20standard=20library=20(patched.15)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-Authored-By: Claude Fable 5.1 --- Dockerfile.runtime | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Dockerfile.runtime b/Dockerfile.runtime index d388ca1..47606a9 100644 --- a/Dockerfile.runtime +++ b/Dockerfile.runtime @@ -3,7 +3,7 @@ ARG VAULT_COMMIT=7193f9a48ff6093ca61b3b627a8671e770428ba6 ARG VAULT_VERSION=2.0.3 -FROM --platform=$BUILDPLATFORM golang:1.26.9-alpine3.24@sha256:cdfd4fe2da6b225d8b40c6b7a105736e548e83ff56d5d8f9394446eeb5eb84e0 AS source +FROM --platform=$BUILDPLATFORM golang:1.26.10-alpine3.24@sha256:9ce231b28998b32e116927c61aa5c406183061d4f3f2d61b292c88e7f6bdf7ca AS source ARG VAULT_COMMIT ARG VAULT_VERSION RUN apk add --no-cache git \ @@ -21,7 +21,7 @@ RUN corepack enable \ && pnpm rebuild node-sass \ && pnpm run build -FROM --platform=$BUILDPLATFORM golang:1.26.9-alpine3.24@sha256:cdfd4fe2da6b225d8b40c6b7a105736e548e83ff56d5d8f9394446eeb5eb84e0 AS builder +FROM --platform=$BUILDPLATFORM golang:1.26.10-alpine3.24@sha256:9ce231b28998b32e116927c61aa5c406183061d4f3f2d61b292c88e7f6bdf7ca AS builder ARG VAULT_COMMIT ARG VAULT_VERSION RUN apk add --no-cache bash git From 73dac36d091b46dd4b05332dea09fbe3251935d3 Mon Sep 17 00:00:00 2001 From: Antoine Toussaint <312536060+antoinetoussaint-byte@users.noreply.github.com> Date: Wed, 21 Oct 2026 16:15:55 -0400 Subject: [PATCH 3/4] fix(runtime-image): the build asserts the Go 1.26.10 toolchain it now uses (patched.16) Co-Authored-By: Claude Fable 5.1 --- Dockerfile.runtime | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile.runtime b/Dockerfile.runtime index 47606a9..42e8a00 100644 --- a/Dockerfile.runtime +++ b/Dockerfile.runtime @@ -45,7 +45,7 @@ RUN --mount=type=cache,target=/go/pkg/mod \ go build -buildvcs=false -tags "vault ui" \ -ldflags "-X github.com/hashicorp/vault/version.GitCommit=${VAULT_COMMIT}+codefly.2 -X github.com/hashicorp/vault/version.BuildDate=${build_date} -X github.com/hashicorp/vault/version.Version=${VAULT_VERSION}" \ -o bin/vault . -RUN go version -m bin/vault | grep -F "go1.26.9" \ +RUN go version -m bin/vault | grep -F "go1.26.10" \ && go version -m bin/vault | grep -F "google.golang.org/grpc" | grep -F "v1.83.2" \ && go version -m bin/vault | grep -F "github.com/apache/thrift" | grep -F "v0.24.0" \ && go version -m bin/vault | grep -F "golang.org/x/crypto" | grep -F "v0.57.0" \ From 7019ad22b96ecb515c735add04da9ce5a5019dfe Mon Sep 17 00:00:00 2001 From: Antoine Toussaint <312536060+antoinetoussaint-byte@users.noreply.github.com> Date: Wed, 21 Oct 2026 16:35:21 -0400 Subject: [PATCH 4/4] fix(runtime-image): pin the published patched.16 image Co-Authored-By: Claude Fable 5.1 --- main.go | 4 ++-- main_test.go | 7 ++++--- 2 files changed, 6 insertions(+), 5 deletions(-) diff --git a/main.go b/main.go index aa2fb13..f469c07 100644 --- a/main.go +++ b/main.go @@ -50,8 +50,8 @@ type Settings struct { var image = &resources.DockerImage{ Name: "ghcr.io/codefly-dev/service-vault-runtime", - Tag: "runtime-v2.0.3-patched.13", - Digest: "sha256:86aa9162af5494eb7bdd1173773037bb7b4dc3632bdf316b27eb345ca2d47355", + Tag: "runtime-v2.0.3-patched.16", + Digest: "sha256:418b04bcfd26211ca40580c8a670cbe55f21e07a81b221f44eded37e8e7b8aa4", } type Service struct { diff --git a/main_test.go b/main_test.go index 1e38075..8629636 100644 --- a/main_test.go +++ b/main_test.go @@ -99,9 +99,10 @@ func TestVaultImageSBOM(t *testing.T) { // Verify the actual binary inventory contains the fixes, even if a scanner // database later drops an advisory or stops recognizing a Go dependency. for module, version := range map[string]string{ - "github.com/apache/thrift": "v0.24.0", - "golang.org/x/net": "v0.60.0", - "google.golang.org/grpc": "v1.83.2", + "github.com/apache/thrift": "v0.24.0", + "github.com/klauspost/compress": "v1.18.7", + "golang.org/x/net": "v0.60.0", + "google.golang.org/grpc": "v1.83.2", } { found := false for _, component := range response.GetBom().GetComponents() {