MOB-51413: CVE fixes - 2026-06-30

[RafaelGuevaraCA]

Jira: MOB-51413

Automated CVE remediation for the blazemeter/taurus Docker image, produced by the prisma-taurus skill and verified in the built image before opening this PR.

Branch-scan comparison (baseline → branch image)

Verified against the taurus-branch-builder image scan (build #572, us.gcr.io/verdant-bulwark-278/taurus:cve-fixes_2026-06-30-572) before opening — integration passed and vulnerabilities dropped.

	total	critical	high	medium	low*
Baseline (prisma-cloud-ondemand-scan #170, unstable)	284	4	44	167	69
Branch image (taurus-branch-builder #572)	281	4	44	164	69

_{* twistcli folds unassigned + negligible into "low".}

Net medium is −3 rather than −4 because a newly disclosed medium — CVE-2026-53655 (npm tar 7.5.15, fixed in 7.5.16) — surfaced after the baseline scan; it is unrelated to these fixes.

Fixes confirmed in the image

All four target CVEs are confirmed no longer flagged in the branch scan.

CVE	Severity	Package	Old → New
CVE-2026-11822	Medium	sqlite3 (libsqlite3-0)	3.45.1-1ubuntu2.5 → 3.45.1-1ubuntu2.6
CVE-2026-11824	Medium	sqlite3 (libsqlite3-0)	3.45.1-1ubuntu2.5 → 3.45.1-1ubuntu2.6
CVE-2026-12318	Medium	nss (libnss3)	2:3.98-1ubuntu0.1 → 2:3.98-1ubuntu0.2
CVE-2026-5704	Medium	tar	1.35+dfsg-3build1 → 1.35+dfsg-3ubuntu0.1

Mechanism: added libsqlite3-0, libnss3, tar to the existing Dockerfile apt-get --only-upgrade block (noble-security/noble-updates, all non-ESM).

This PR also folds two durable lessons into vulnerability_history.md (setuptools-vendored findings are blocked by setup.py's pkg_resources use; the npm cached-layer / undici note).

Not fixed — out of scope or requires manual intervention

• 102 JMeter/Gatling bundled-jar findings (incl. all 4 criticals — Apache Tika tika-core/tika-parsers, and ~38 highs: netty, log4j, xstream, jackson-databind, dnsjava, batik, logback, xalan, json-smart) — out of scope (no individual jar repin, no JMeter/Gatling version bump).
• Ubuntu Pro ESM-only fixes (ffmpeg, gnuplot, openexr, qtbase, gst-plugins-bad, fonttools, apt python-pip) — fixed versions end in +esmN/~esm1; not installable without an Ubuntu Pro subscription.
• k6-embedded Go libraries (golang.org/x/net, crypto/x509, etc. under /usr/bin/k6) — only changeable by upgrading the k6 binary.
• setuptools-vendored wheel (CVE-2026-24049) and jaraco.context (CVE-2026-23949) — clearing requires setuptools ≥ 82, which removes pkg_resources that setup.py imports to build the wheel; deferred (would break the build for one medium + one low).
• npm-internal undici 6.26.0 (4 low) — auto-clears on an uncached rebuild (npm 11.18.0 bundles the fixed undici 6.27.0); monitor.
• 109 findings with no released fix (Fix Status = open / needed / deferred) — monitor.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Updates the Taurus Docker image to remediate specific medium-severity CVEs by upgrading a small set of OS packages during the image build, and documents remediation learnings for future automated CVE runs.

Changes:

• Extend the Dockerfile’s apt-get --only-upgrade block to upgrade libsqlite3-0, libnss3, and tar to patched Ubuntu Noble security/updates versions.
• Add guidance to vulnerability_history.md explaining why setuptools-vendored findings are currently blocked by setup.py’s pkg_resources usage, plus an update on npm/undici cache-layer behavior.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
Dockerfile	Adds libsqlite3-0, libnss3, and tar to the existing OS package upgrade block to address targeted CVEs.
.claude/skills/prisma-taurus/vulnerability_history.md	Documents new remediation constraints/lessons learned (setuptools-vendored + npm cached layer behavior).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 88.08%. Comparing base (f69a12b) to head (d57cf2e).

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #2001      +/-   ##
==========================================
- Coverage   88.09%   88.08%   -0.00%     
==========================================
  Files          73       73              
  Lines       20935    20935              
==========================================
- Hits        18441    18439       -2     
- Misses       2494     2496       +2     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.