[container-image-scan] Container findings for gh-aw-firewall/api-proxy

[github-actions]

Summary

Container image ghcr.io/github/gh-aw-firewall/api-proxy:0.27.43 (pinned: @sha256:d85f57975af5ea23af4996e41ed73fbc8f5b4a47402472bfe82e508f352cb0c1) has 7 vulnerabilities and 35 license policy violations identified by the daily Syft/Grype/Grant scan.

• Vulnerabilities: 0 Critical, 4 High, 2 Medium, 1 Negligible
• License violations: 35 packages with rejected/unrecognized licenses (mostly Go modules with "no licenses found" plus some GPL/AGPL-3.0 components)

Remediation

• Rebuild the image after upstream Debian security updates are published for nodejs/openssl/libssh2 to pick up fixed package versions listed below.
• Review flagged Go modules lacking detected license metadata; confirm actual licenses and add per-package license overrides/allowlist entries if compliant, or replace with alternatives if not.
• Re-run the scan after remediation to confirm the findings clear.

Vulnerabilities

Full vulnerability list (7)

Severity	ID	Package	Version	Fixed Version
High	CVE-2026-21710	libnode-dev	20.19.2+dfsg-1	20.19.2+dfsg-1+deb13u2
High	CVE-2026-21710	libnode115	20.19.2+dfsg-1	20.19.2+dfsg-1+deb13u2
High	CVE-2026-21710	nodejs	20.19.2+dfsg-1	20.19.2+dfsg-1+deb13u2
High	CVE-2026-45447	libssl3t64	3.5.4-1~deb13u2	3.5.6-1~deb13u2
Medium	CVE-2026-48618	nodejs	20.19.2+dfsg-1	(none published)
Medium	CVE-2025-23085	nodejs	20.19.2+dfsg-1	20.19.2+dfsg-1+deb13u1
Negligible	CVE-2011-3389	libgnutls30t64	3.8.9-3+deb13u1	(none published)

License Violations

Full license violation list (35)

Package	Version	License(s)
ssl_client	1.37.0-r31	GPL-2.0-only
ca-certificates-bundle	20260611-r0	MPL-2.0
qrcode-terminal	0.12.0	Apache 2.0
apk-tools	3.0.6-r0	GPL-2.0-only
glob	13.0.6	BlueOak-1.0.0
scanelf	1.3.9-r1	GPL-2.0-only
libapk	3.0.6-r0	GPL-2.0-only
spdx-exceptions	2.5.0	CC-BY-3.0
alpine-baselayout	3.7.2-r1	GPL-2.0-only
busybox-binsh	1.37.0-r31	GPL-2.0-only
yallist	5.0.0	BlueOak-1.0.0
npm	11.18.0	Artistic-2.0
awf-api-proxy	1.0.0	no licenses found
libgcc	15.2.0-r5	GPL-2.0-or-later, LGPL-2.1-or-later
libidn2	2.3.8-r0	GPL-2.0-or-later, LGPL-3.0-or-later
isexe	4.0.0	BlueOak-1.0.0
lru-cache	11.5.1	BlueOak-1.0.0
libunistring	1.4.2-r0	GPL-2.0-or-later, LGPL-3.0-or-later
node	22.23.1	no licenses found
minipass-flush	1.0.6	BlueOak-1.0.0
tar	7.5.19	BlueOak-1.0.0
path-scurry	2.0.2	BlueOak-1.0.0
chownr	3.0.0	BlueOak-1.0.0
minipass	7.1.3	BlueOak-1.0.0
curl	8.21.0-r0	curl
zlib	1.3.2-r0	Zlib
common-ancestor-path	2.0.0	BlueOak-1.0.0
alpine-baselayout-data	3.7.2-r1	GPL-2.0-only
libstdc++	15.2.0-r5	GPL-2.0-or-later, LGPL-2.1-or-later
zstd-libs	1.5.7-r2	GPL-2.0-or-later
spdx-license-ids	3.0.23	CC0-1.0
busybox	1.37.0-r31	GPL-2.0-only
musl-utils	1.2.6-r2	GPL-2.0-or-later
minimatch	10.2.5	BlueOak-1.0.0
libcurl	8.21.0-r0	curl

Remediation: most flagged items are copyleft (GPL/LGPL/MPL) base-image components inherent to Alpine/Node runtime layers and are typically acceptable for container distribution (not linked into proprietary code) — verify against org license policy allowlist. Items with "no licenses found" (awf-api-proxy, node) need license metadata to be added/verified in the build; BlueOak-1.0.0/CC0/CC-BY items are generally permissive and likely just need to be added to the allowlist.

Generated by 🛡️ Daily Container Image Security Scan · auto · 322.2 AIC · ⌖ 3.23 AIC · ⊞ 6.4K · ◷

[github-actions]

🍪 Issue Monster selected this for Copilot

I have identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

🍪 Om nom nom by Issue Monster · gpt54 · 3.94 AIC · ⌖ 5.41 AIC · ⊞ 8.9K · ◷