fix(deps): adopt patched claircore and re-establish the SSRF verdict

[devantler]

🤖 Generated by the Agentic Engineer

Why

A security advisory against the claircore library has been open on KSail since 17 July, tracked as
#6198 and parked on the belief that no patched release existed. A patched release does exist —
the desktop module has already been running it since 23 July, and its half of the alert closed
automatically at that point. Only the root module was still holding the affected version, so the
alert stayed open with nobody acting on it.

What

Root moves onto the same patched claircore release desktop already runs, which takes it outside
the advisory's affected range and should close the remaining alert.

The repository guards this dependency deliberately: it refuses any version change until the
"can an attacker actually reach this?" verdict is re-established, and it forbids one module from
inheriting another module's verdict. That verdict was re-established against the root module's own
dependency graph — the vulnerable component is still not reachable from KSail — and the guard was
retargeted from a hard-coded list of package names to the property it is actually protecting, so it
cannot quietly go stale the next time this happens.

No product behaviour changes; this is a dependency and its safety guard.

Fixes #6198

Supersedes automation's half-fix: Dependabot proposed the same version bump in #6342 on 23 July
and it has sat open since. A dependency bot can move the version but cannot re-establish the safety
verdict the repo requires alongside it, so that PR could never complete on its own. This delivers
both halves; #6342 becomes redundant once this lands.

[github-actions]

✅MegaLinter analysis: Success

✅ Linters with no issues

actionlint, bash-exec, git_diff, hadolint, jscpd, jsonlint, lychee, markdown-table-formatter, markdownlint, prettier, prettier, shellcheck, shfmt, stylelint, syft, trivy-sbom, trufflehog, v8r, v8r, yamllint

Notices

📣 MegaLinter 9.5.0 is out! Discover the new features and security recommendations in the release announcement. (Skip this info by defining SECURITY_SUGGESTIONS: false)

See detailed reports in MegaLinter artifacts

Show us your support by starring ⭐ the repository

[devantler]

🤖 Generated by the Agentic Engineer

Verification record

Condition 3 (tried and evaluated as a user). This change's user-facing surface is the guard, so
I exercised the guard rather than tracing it. All runs uncached (-count=1), on head e950d623.

Check	Result
GREEN — full Claircore suite on this branch	ok (3.8s)
RED — main's guard against this branch's patched go.mod	FAIL, root only: uses github.com/quay/claircore "v1.5.53"; re-establish the #6008 SSRF reachability verdict before updating the audited version "v1.5.35"
Ablation A — drop a package root genuinely links (osrelease) from root's audit	FAIL naming that exact package; desktop's subtest still passed ⇒ per-module independence holds
Ablation B — admit a package root does not link into both audits	FAIL on the retargeted tripwire: root audit admits desktop-audited package … that root does not link; remove it rather than inheriting desktop's verdict

Ablation B is the one that matters for the retarget: TestClaircoreLinkedPackagesStayInert did not
fire there — only the tripwire did. An over-broad audit inheriting another module's verdict is
structurally invisible to the linkage check, which is precisely the gap the retarget closes.

I also measured the audit against reality: both modules link exactly the 9 audited packages —
the allow-list is neither over- nor under-broad.

The fix itself is confirmed against a live oracle, not reasoned. GitHub's own Dependabot state:

Alert	Manifest	State	Affected range
165	desktop/go.mod	fixed	<= 1.5.52
166	go.mod (root)	open	<= 1.5.52

Same advisory, two manifests. GitHub already closed 165 when desktop adopted v1.5.53 — the exact
release this PR moves root onto. That is why #6198 sat parked as "no patched version exists" for 16
days despite first_patched_version still reading null: the field was never the evidence, the
sibling manifest was.

Ablations restored and the tree verified clean after each.

[devantler]

🤖 Generated by the Agentic Engineer

@coderabbitai review

[coderabbitai]

@devantler I will review the changes in #6448.

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

📝 Walkthrough

Walkthrough

The PR updates indirect dependency versions, including Claircore and its toolkit, and removes the indirect zerolog dependency. It updates Claircore audit versions and inert package allow-lists. The linkage audit now uses the root module’s actual dependency graph, compares it with the desktop audit, sorts inherited package findings, and reports go list failures with stderr.

Possibly related issues

• Track Claircore manifest URI SSRF exposure #6008: This issue also concerns Claircore SSRF exposure and verifies Claircore reachability through Kubescape.

Possibly related PRs

• devantler-tech/ksail#6012: This PR extends the Claircore linkage guard test introduced there.
• devantler-tech/ksail#6344: This PR extends the Claircore audit logic and dependency-graph checks introduced there.
• devantler-tech/ksail#6382: This PR updates Claircore versions and verifies linked-package reachability.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The PR adopts claircore v1.5.53 and re-establishes the root reachability guard, satisfying the linked issue's coding objectives.
Out of Scope Changes check	✅ Passed	The dependency and test changes support the claircore update and its safety guard; no unrelated product changes are shown.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Title check	✅ Passed	The title clearly summarizes the patched Claircore dependency update and the restored SSRF verdict.
Description check	✅ Passed	The description directly explains the Claircore update, SSRF reachability guard, linked issue, and absence of product behavior changes.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devantler]

🤖 Generated by the Agentic Engineer

Readiness — self-promoting

Condition	Evidence
1. Programmatically tested	71/71 checks green, 0 failures. Plus, locally and uncached: guard suite GREEN, main's guard RED against this go.mod, and both ablations firing on the right guard.
2. Reviewed	cr@e950d6232b — CodeRabbit summary at exactly this head, "No actionable comments were generated", no finding sections, no quota marker. 0 unresolved threads.
3. Tried and evaluated as a user	The guard is this change's user surface and I exercised it directly (record above). The fix itself is confirmed against a live oracle rather than reasoned: GitHub already closed the sibling manifest's alert at this exact release.

mergeStateStatus: CLEAN. Merging.