Problem
Rebuild the arxiv, ast-grep, context7, grafana, memory, and serena sandbox images now — the "Enforce critical vulnerability and license gates" step has failed every day for at least 5 consecutive days, and the underlying CVEs are real, not gate noise.
Affected workflow and runs
Daily Container Image Security Scan (daily-squid-image-scan.lock.yml), failing at the Enforce critical vulnerability and license gates step on every scheduled run in the window:
Root cause
The gate is correct — it is finding real critical CVEs with published fixes that the images simply have not picked up yet:
- openssl/libssl3: CVE-2026-31789, CVE-2026-34182, CVE-2025-15467 (fixed upstream in Debian/Alpine) — hits arxiv, ast-grep, context7, memory, serena
- glibc: CVE-2026-5450 (libc6/libc-bin) — hits arxiv, grafana, serena
- perl-base: CVE-2026-12087, CVE-2026-13221, CVE-2026-42496, CVE-2026-57433, CVE-2026-8376 — hits arxiv, grafana, serena
- Node.js: CVE-2025-55130 — hits context7, memory, serena
- tar: GHSA-23hp-3jrh-7fpw (fix 7.5.19) — hits context7, memory
- serena alone carries 62 critical findings including golang stdlib (GO-2026-4337) and libcurl (CVE-2026-10536/11856/8924/8926/8927/9079), none of which have moved in 5+ days.
Nearly all entries list an available fix: version from the Debian/Alpine security tracker — this is a stale-base-image problem, not an unfixable upstream issue.
Proposed remediation
- Rebuild arxiv, ast-grep, context7, grafana, memory, and serena against current Debian/Alpine base tags to pick up patched openssl, libssl3, glibc, perl-base, and node packages.
- Bump the
tar npm dependency in context7/memory to ≥7.5.19.
- Re-run the scan after rebuild and confirm all
*_Critical.txt outputs are empty before relying on the gate again.
Success criteria
- Daily Container Image Security Scan passes with 0 critical findings across all 7 images on the next scheduled run.
- No new critical CVEs reappear for at least 5 consecutive daily runs after the rebuild.
cc parent tracking: #48898
Related to #48898
Generated by 🔍 [aw] Failure Investigator (6h) · agent · 213.3 AIC · ⊞ 5.2K · ◷
Problem
Rebuild the arxiv, ast-grep, context7, grafana, memory, and serena sandbox images now — the "Enforce critical vulnerability and license gates" step has failed every day for at least 5 consecutive days, and the underlying CVEs are real, not gate noise.
Affected workflow and runs
Daily Container Image Security Scan (
daily-squid-image-scan.lock.yml), failing at theEnforce critical vulnerability and license gatesstep on every scheduled run in the window:Root cause
The gate is correct — it is finding real critical CVEs with published fixes that the images simply have not picked up yet:
Nearly all entries list an available
fix:version from the Debian/Alpine security tracker — this is a stale-base-image problem, not an unfixable upstream issue.Proposed remediation
tarnpm dependency in context7/memory to ≥7.5.19.*_Critical.txtoutputs are empty before relying on the gate again.Success criteria
cc parent tracking: #48898
Related to #48898