Skip to content

Conversation

Le-Caignec
Copy link
Contributor

@Le-Caignec Le-Caignec commented Apr 4, 2025

  • Set up a modern test stack as the Voucher Subgraph repository (agnostic to the forked network).
  • Move to ESM to support new test stack
  • Modify the integration tests to work with the new test stack and validate it.

TODO in a next PR :

- Introduced .dockerignore and Dockerfile for containerization.
- Updated networks.json with new addresses and start blocks.
- Enhanced package.json with new scripts for cleaning and managing the build process.
- Created .gitignore for test-stack to exclude .env files.
- Added docker-compose.yml to define services for the test environment.
- Implemented prepare-test-env.js for dynamic environment variable generation.
- Removed tsconfig.json as it is no longer needed.
@Le-Caignec Le-Caignec changed the title Add Docker support and environment setup for poco-subgraph feature/setup-agnostic-test-stack-based-on-fork Apr 4, 2025
@Le-Caignec Le-Caignec self-assigned this Apr 4, 2025
@Le-Caignec Le-Caignec marked this pull request as draft April 4, 2025 15:04
…pose to use dynamic NETWORK_NAME for Ethereum service
- Added a new script to generate TypeChain types for ethers-v6 in package.json.
- Updated the start-test-stack script to ensure proper environment setup.
- Modified the itest script to include NETWORK_NAME in the environment.
- Removed unused callHandlers from subgraph.yaml.
- Enhanced docker-compose.yml to include a stack-ready service for better orchestration.
- Updated prepare-test-env.js to conditionally update networks.json based on NETWORK_NAME.
- Introduced tsconfig.json for TypeScript configuration with strict settings.
@Le-Caignec Le-Caignec marked this pull request as ready for review April 14, 2025 08:57
@Le-Caignec Le-Caignec requested review from gfournieriExec, james-toussaint and zguesmi and removed request for gfournieriExec April 14, 2025 08:57
Copy link
Contributor Author

@Le-Caignec Le-Caignec Apr 14, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The integration test file has been modified because the forked test stack doesn’t index events at the time of PoCo deployment (need archieve node - too long - not recommended). The test stack only starts indexing once the stack is fully initialized. This is why we use typechains to trigger a transaction and verify that the corresponding event has been correctly indexed.

@@ -0,0 +1,15 @@
# iexec-poco-subgraph deployer

FROM node:20
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

what is the difference with ./docker/Dockerfile

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It’s the same. But according to Ugo, it’s better to move this file to root level for the GitHub Action CI. That’s why he also moved it to the root of the voucher subgraph repo.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You can add a comment at the top of the file to explain why we have both files.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

So we should remove the one in ./docker/Dockerfile ?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah, as mentioned in the PR description, the Docker folder will be removed in another PR since the new Docker Compose is network-agnostic.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

why not use node 22 ?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

All our repositories — voucher-subgraph, voucher-contract — are using Node 20.
I think we should stay consistent. But you’re right, we do need to move to Node 22.
Maybe we can discuss it during our Web3 daily.

@Le-Caignec Le-Caignec requested a review from zguesmi April 17, 2025 09:03
* Remove obsolete Docker configurations, environment files, and subgraph definitions for bellecour, test, and viviani. Refactor unit tests for IexecCategoryManager and IexecPoco, consolidating mock utilities and event parameter builders into a unified structure.
* chore: update GitHub workflows for coverage, deployment, and testing

* refactor: add formatting scripts and .prettierignore for code consistency

* chore: update dependencies in package.json
Copy link

🔒 Trivy Security Scan Results

Click to expand detailed results

For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://aquasecurity.github.io/trivy/v0.57/docs/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


vuln-image.tar (debian 12.10)
=============================
Total: 23 (HIGH: 23, CRITICAL: 0)

┌───────────────────┬────────────────┬──────────┬────────┬───────────────────┬──────────────────┬──────────────────────────────────────────────────────────────┐
│      Library      │ Vulnerability  │ Severity │ Status │ Installed Version │  Fixed Version   │                            Title                             │
├───────────────────┼────────────────┼──────────┼────────┼───────────────────┼──────────────────┼──────────────────────────────────────────────────────────────┤
│ libperl5.36       │ CVE-2024-56406 │ HIGH     │ fixed  │ 5.36.0-7+deb12u1  │ 5.36.0-7+deb12u2 │ perl: Perl 5.34, 5.36, 5.38 and 5.40 are vulnerable to a     │
│                   │                │          │        │                   │                  │ heap...                                                      │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2024-56406                   │
├───────────────────┼────────────────┤          │        ├───────────────────┼──────────────────┼──────────────────────────────────────────────────────────────┤
│ linux-libc-dev    │ CVE-2024-26982 │          │        │ 6.1.129-1         │ 6.1.133-1        │ kernel: Squashfs: check the inode number is not the invalid  │
│                   │                │          │        │                   │                  │ value of...                                                  │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2024-26982                   │
│                   ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                   │ CVE-2024-35866 │          │        │                   │                  │ kernel: smb: client: fix potential UAF in                    │
│                   │                │          │        │                   │                  │ cifs_dump_full_key()                                         │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2024-35866                   │
│                   ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                   │ CVE-2024-50246 │          │        │                   │                  │ kernel: fs/ntfs3: Add rough attr alloc_size check            │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2024-50246                   │
│                   ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                   │ CVE-2024-53166 │          │        │                   │                  │ kernel: block, bfq: fix bfqq uaf in bfq_limit_depth()        │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2024-53166                   │
│                   ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                   │ CVE-2024-58002 │          │        │                   │                  │ kernel: media: uvcvideo: Remove dangling pointers            │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2024-58002                   │
│                   ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                   │ CVE-2025-21702 │          │        │                   │                  │ kernel: pfifo_tail_enqueue: Drop new packet when sch->limit  │
│                   │                │          │        │                   │                  │ == 0                                                         │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-21702                   │
│                   ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                   │ CVE-2025-21855 │          │        │                   │                  │ kernel: ibmvnic: Don't reference skb after sending to VIOS   │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-21855                   │
│                   ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                   │ CVE-2025-21858 │          │        │                   │                  │ kernel: geneve: Fix use-after-free in geneve_find_dev().     │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-21858                   │
│                   ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                   │ CVE-2025-21905 │          │        │                   │                  │ kernel: wifi: iwlwifi: limit printed string from FW file     │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-21905                   │
│                   ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                   │ CVE-2025-21919 │          │        │                   │                  │ kernel: sched/fair: Fix potential memory corruption in       │
│                   │                │          │        │                   │                  │ child_cfs_rq_on_list                                         │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-21919                   │
│                   ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                   │ CVE-2025-21920 │          │        │                   │                  │ kernel: vlan: enforce underlying device type                 │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-21920                   │
│                   ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                   │ CVE-2025-21926 │          │        │                   │                  │ kernel: net: gso: fix ownership in __udp_gso_segment         │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-21926                   │
│                   ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                   │ CVE-2025-21928 │          │        │                   │                  │ kernel: HID: intel-ish-hid: Fix use-after-free issue in      │
│                   │                │          │        │                   │                  │ ishtp_hid_remove()                                           │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-21928                   │
│                   ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                   │ CVE-2025-21934 │          │        │                   │                  │ kernel: rapidio: fix an API misues when rio_add_net() fails  │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-21934                   │
│                   ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                   │ CVE-2025-21945 │          │        │                   │                  │ kernel: ksmbd: fix use-after-free in smb2_lock               │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-21945                   │
│                   ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                   │ CVE-2025-21968 │          │        │                   │                  │ kernel: drm/amd/display: Fix slab-use-after-free on          │
│                   │                │          │        │                   │                  │ hdcp_work                                                    │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-21968                   │
│                   ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                   │ CVE-2025-21979 │          │        │                   │                  │ kernel: wifi: cfg80211: cancel wiphy_work before freeing     │
│                   │                │          │        │                   │                  │ wiphy                                                        │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-21979                   │
│                   ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                   │ CVE-2025-21991 │          │        │                   │                  │ kernel: x86/microcode/AMD: Fix out-of-bounds on systems with │
│                   │                │          │        │                   │                  │ CPU-less NUMA nodes                                          │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-21991                   │
│                   ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                   │ CVE-2025-21993 │          │        │                   │                  │ kernel: iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in │
│                   │                │          │        │                   │                  │ ibft_attr_show_nic()                                         │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-21993                   │
├───────────────────┼────────────────┤          │        ├───────────────────┼──────────────────┼──────────────────────────────────────────────────────────────┤
│ perl              │ CVE-2024-56406 │          │        │ 5.36.0-7+deb12u1  │ 5.36.0-7+deb12u2 │ perl: Perl 5.34, 5.36, 5.38 and 5.40 are vulnerable to a     │
│                   │                │          │        │                   │                  │ heap...                                                      │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2024-56406                   │
├───────────────────┤                │          │        │                   │                  │                                                              │
│ perl-base         │                │          │        │                   │                  │                                                              │
│                   │                │          │        │                   │                  │                                                              │
│                   │                │          │        │                   │                  │                                                              │
├───────────────────┤                │          │        │                   │                  │                                                              │
│ perl-modules-5.36 │                │          │        │                   │                  │                                                              │
│                   │                │          │        │                   │                  │                                                              │
│                   │                │          │        │                   │                  │                                                              │
└───────────────────┴────────────────┴──────────┴────────┴───────────────────┴──────────────────┴──────────────────────────────────────────────────────────────┘

Node.js (node-pkg)
==================
Total: 7 (HIGH: 6, CRITICAL: 1)

┌────────────────────────────────────────┬────────────────┬──────────┬────────┬───────────────────┬─────────────────────┬──────────────────────────────────────────────────────────────┐
│                Library                 │ Vulnerability  │ Severity │ Status │ Installed Version │    Fixed Version    │                            Title                             │
├────────────────────────────────────────┼────────────────┼──────────┼────────┼───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ @openzeppelin/contracts (package.json) │ CVE-2021-46320 │ HIGH     │ fixed  │ 3.2.0             │ 4.4.1               │ Improper Initialization in OpenZeppelin                      │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2021-46320                   │
│                                        ├────────────────┼──────────┤        ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│                                        │ CVE-2021-39167 │ CRITICAL │        │ 3.3.0             │ 4.3.1, 3.4.2        │ TimelockController vulnerability in OpenZeppelin Contracts   │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2021-39167                   │
│                                        ├────────────────┼──────────┤        │                   ├─────────────────────┼──────────────────────────────────────────────────────────────┤
│                                        │ CVE-2021-46320 │ HIGH     │        │                   │ 4.4.1               │ Improper Initialization in OpenZeppelin                      │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2021-46320                   │
├────────────────────────────────────────┼────────────────┤          │        ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ axios (package.json)                   │ CVE-2025-27152 │          │        │ 0.21.4            │ 1.8.2, 0.30.0       │ axios: Possible SSRF and Credential Leakage via Absolute URL │
│                                        │                │          │        │                   │                     │ in axios Requests...                                         │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2025-27152                   │
├────────────────────────────────────────┼────────────────┤          │        ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ cross-spawn (package.json)             │ CVE-2024-21538 │          │        │ 7.0.3             │ 7.0.5, 6.0.6        │ cross-spawn: regular expression denial of service            │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2024-21538                   │
│                                        │                │          │        │                   │                     │                                                              │
│                                        │                │          │        │                   │                     │                                                              │
│                                        │                │          │        │                   │                     │                                                              │
├────────────────────────────────────────┼────────────────┤          │        ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ semver (package.json)                  │ CVE-2022-25883 │          │        │ 7.3.5             │ 7.5.2, 6.3.1, 5.7.2 │ nodejs-semver: Regular expression denial of service          │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2022-25883                   │
└────────────────────────────────────────┴────────────────┴──────────┴────────┴───────────────────┴─────────────────────┴──────────────────────────────────────────────────────────────┘

Copy link

🔒 Trivy Security Scan Results

Click to expand detailed results

For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://aquasecurity.github.io/trivy/v0.57/docs/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


vuln-image.tar (debian 12.10)
=============================
Total: 23 (HIGH: 23, CRITICAL: 0)

┌───────────────────┬────────────────┬──────────┬────────┬───────────────────┬──────────────────┬──────────────────────────────────────────────────────────────┐
│      Library      │ Vulnerability  │ Severity │ Status │ Installed Version │  Fixed Version   │                            Title                             │
├───────────────────┼────────────────┼──────────┼────────┼───────────────────┼──────────────────┼──────────────────────────────────────────────────────────────┤
│ libperl5.36       │ CVE-2024-56406 │ HIGH     │ fixed  │ 5.36.0-7+deb12u1  │ 5.36.0-7+deb12u2 │ perl: Perl 5.34, 5.36, 5.38 and 5.40 are vulnerable to a     │
│                   │                │          │        │                   │                  │ heap...                                                      │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2024-56406                   │
├───────────────────┼────────────────┤          │        ├───────────────────┼──────────────────┼──────────────────────────────────────────────────────────────┤
│ linux-libc-dev    │ CVE-2024-26982 │          │        │ 6.1.129-1         │ 6.1.133-1        │ kernel: Squashfs: check the inode number is not the invalid  │
│                   │                │          │        │                   │                  │ value of...                                                  │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2024-26982                   │
│                   ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                   │ CVE-2024-35866 │          │        │                   │                  │ kernel: smb: client: fix potential UAF in                    │
│                   │                │          │        │                   │                  │ cifs_dump_full_key()                                         │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2024-35866                   │
│                   ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                   │ CVE-2024-50246 │          │        │                   │                  │ kernel: fs/ntfs3: Add rough attr alloc_size check            │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2024-50246                   │
│                   ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                   │ CVE-2024-53166 │          │        │                   │                  │ kernel: block, bfq: fix bfqq uaf in bfq_limit_depth()        │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2024-53166                   │
│                   ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                   │ CVE-2024-58002 │          │        │                   │                  │ kernel: media: uvcvideo: Remove dangling pointers            │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2024-58002                   │
│                   ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                   │ CVE-2025-21702 │          │        │                   │                  │ kernel: pfifo_tail_enqueue: Drop new packet when sch->limit  │
│                   │                │          │        │                   │                  │ == 0                                                         │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-21702                   │
│                   ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                   │ CVE-2025-21855 │          │        │                   │                  │ kernel: ibmvnic: Don't reference skb after sending to VIOS   │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-21855                   │
│                   ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                   │ CVE-2025-21858 │          │        │                   │                  │ kernel: geneve: Fix use-after-free in geneve_find_dev().     │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-21858                   │
│                   ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                   │ CVE-2025-21905 │          │        │                   │                  │ kernel: wifi: iwlwifi: limit printed string from FW file     │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-21905                   │
│                   ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                   │ CVE-2025-21919 │          │        │                   │                  │ kernel: sched/fair: Fix potential memory corruption in       │
│                   │                │          │        │                   │                  │ child_cfs_rq_on_list                                         │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-21919                   │
│                   ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                   │ CVE-2025-21920 │          │        │                   │                  │ kernel: vlan: enforce underlying device type                 │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-21920                   │
│                   ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                   │ CVE-2025-21926 │          │        │                   │                  │ kernel: net: gso: fix ownership in __udp_gso_segment         │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-21926                   │
│                   ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                   │ CVE-2025-21928 │          │        │                   │                  │ kernel: HID: intel-ish-hid: Fix use-after-free issue in      │
│                   │                │          │        │                   │                  │ ishtp_hid_remove()                                           │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-21928                   │
│                   ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                   │ CVE-2025-21934 │          │        │                   │                  │ kernel: rapidio: fix an API misues when rio_add_net() fails  │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-21934                   │
│                   ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                   │ CVE-2025-21945 │          │        │                   │                  │ kernel: ksmbd: fix use-after-free in smb2_lock               │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-21945                   │
│                   ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                   │ CVE-2025-21968 │          │        │                   │                  │ kernel: drm/amd/display: Fix slab-use-after-free on          │
│                   │                │          │        │                   │                  │ hdcp_work                                                    │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-21968                   │
│                   ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                   │ CVE-2025-21979 │          │        │                   │                  │ kernel: wifi: cfg80211: cancel wiphy_work before freeing     │
│                   │                │          │        │                   │                  │ wiphy                                                        │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-21979                   │
│                   ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                   │ CVE-2025-21991 │          │        │                   │                  │ kernel: x86/microcode/AMD: Fix out-of-bounds on systems with │
│                   │                │          │        │                   │                  │ CPU-less NUMA nodes                                          │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-21991                   │
│                   ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                   │ CVE-2025-21993 │          │        │                   │                  │ kernel: iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in │
│                   │                │          │        │                   │                  │ ibft_attr_show_nic()                                         │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-21993                   │
├───────────────────┼────────────────┤          │        ├───────────────────┼──────────────────┼──────────────────────────────────────────────────────────────┤
│ perl              │ CVE-2024-56406 │          │        │ 5.36.0-7+deb12u1  │ 5.36.0-7+deb12u2 │ perl: Perl 5.34, 5.36, 5.38 and 5.40 are vulnerable to a     │
│                   │                │          │        │                   │                  │ heap...                                                      │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2024-56406                   │
├───────────────────┤                │          │        │                   │                  │                                                              │
│ perl-base         │                │          │        │                   │                  │                                                              │
│                   │                │          │        │                   │                  │                                                              │
│                   │                │          │        │                   │                  │                                                              │
├───────────────────┤                │          │        │                   │                  │                                                              │
│ perl-modules-5.36 │                │          │        │                   │                  │                                                              │
│                   │                │          │        │                   │                  │                                                              │
│                   │                │          │        │                   │                  │                                                              │
└───────────────────┴────────────────┴──────────┴────────┴───────────────────┴──────────────────┴──────────────────────────────────────────────────────────────┘

Node.js (node-pkg)
==================
Total: 7 (HIGH: 6, CRITICAL: 1)

┌────────────────────────────────────────┬────────────────┬──────────┬────────┬───────────────────┬─────────────────────┬──────────────────────────────────────────────────────────────┐
│                Library                 │ Vulnerability  │ Severity │ Status │ Installed Version │    Fixed Version    │                            Title                             │
├────────────────────────────────────────┼────────────────┼──────────┼────────┼───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ @openzeppelin/contracts (package.json) │ CVE-2021-46320 │ HIGH     │ fixed  │ 3.2.0             │ 4.4.1               │ Improper Initialization in OpenZeppelin                      │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2021-46320                   │
│                                        ├────────────────┼──────────┤        ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│                                        │ CVE-2021-39167 │ CRITICAL │        │ 3.3.0             │ 4.3.1, 3.4.2        │ TimelockController vulnerability in OpenZeppelin Contracts   │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2021-39167                   │
│                                        ├────────────────┼──────────┤        │                   ├─────────────────────┼──────────────────────────────────────────────────────────────┤
│                                        │ CVE-2021-46320 │ HIGH     │        │                   │ 4.4.1               │ Improper Initialization in OpenZeppelin                      │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2021-46320                   │
├────────────────────────────────────────┼────────────────┤          │        ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ axios (package.json)                   │ CVE-2025-27152 │          │        │ 0.21.4            │ 1.8.2, 0.30.0       │ axios: Possible SSRF and Credential Leakage via Absolute URL │
│                                        │                │          │        │                   │                     │ in axios Requests...                                         │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2025-27152                   │
├────────────────────────────────────────┼────────────────┤          │        ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ cross-spawn (package.json)             │ CVE-2024-21538 │          │        │ 7.0.3             │ 7.0.5, 6.0.6        │ cross-spawn: regular expression denial of service            │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2024-21538                   │
│                                        │                │          │        │                   │                     │                                                              │
│                                        │                │          │        │                   │                     │                                                              │
│                                        │                │          │        │                   │                     │                                                              │
├────────────────────────────────────────┼────────────────┤          │        ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ semver (package.json)                  │ CVE-2022-25883 │          │        │ 7.3.5             │ 7.5.2, 6.3.1, 5.7.2 │ nodejs-semver: Regular expression denial of service          │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2022-25883                   │
└────────────────────────────────────────┴────────────────┴──────────┴────────┴───────────────────┴─────────────────────┴──────────────────────────────────────────────────────────────┘

Copy link

🔒 Trivy Security Scan Results

Click to expand detailed results

For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://aquasecurity.github.io/trivy/v0.57/docs/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


vuln-image.tar (debian 12.10)
=============================
Total: 23 (HIGH: 23, CRITICAL: 0)

┌───────────────────┬────────────────┬──────────┬────────┬───────────────────┬──────────────────┬──────────────────────────────────────────────────────────────┐
│      Library      │ Vulnerability  │ Severity │ Status │ Installed Version │  Fixed Version   │                            Title                             │
├───────────────────┼────────────────┼──────────┼────────┼───────────────────┼──────────────────┼──────────────────────────────────────────────────────────────┤
│ libperl5.36       │ CVE-2024-56406 │ HIGH     │ fixed  │ 5.36.0-7+deb12u1  │ 5.36.0-7+deb12u2 │ perl: Perl 5.34, 5.36, 5.38 and 5.40 are vulnerable to a     │
│                   │                │          │        │                   │                  │ heap...                                                      │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2024-56406                   │
├───────────────────┼────────────────┤          │        ├───────────────────┼──────────────────┼──────────────────────────────────────────────────────────────┤
│ linux-libc-dev    │ CVE-2024-26982 │          │        │ 6.1.129-1         │ 6.1.133-1        │ kernel: Squashfs: check the inode number is not the invalid  │
│                   │                │          │        │                   │                  │ value of...                                                  │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2024-26982                   │
│                   ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                   │ CVE-2024-35866 │          │        │                   │                  │ kernel: smb: client: fix potential UAF in                    │
│                   │                │          │        │                   │                  │ cifs_dump_full_key()                                         │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2024-35866                   │
│                   ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                   │ CVE-2024-50246 │          │        │                   │                  │ kernel: fs/ntfs3: Add rough attr alloc_size check            │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2024-50246                   │
│                   ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                   │ CVE-2024-53166 │          │        │                   │                  │ kernel: block, bfq: fix bfqq uaf in bfq_limit_depth()        │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2024-53166                   │
│                   ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                   │ CVE-2024-58002 │          │        │                   │                  │ kernel: media: uvcvideo: Remove dangling pointers            │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2024-58002                   │
│                   ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                   │ CVE-2025-21702 │          │        │                   │                  │ kernel: pfifo_tail_enqueue: Drop new packet when sch->limit  │
│                   │                │          │        │                   │                  │ == 0                                                         │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-21702                   │
│                   ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                   │ CVE-2025-21855 │          │        │                   │                  │ kernel: ibmvnic: Don't reference skb after sending to VIOS   │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-21855                   │
│                   ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                   │ CVE-2025-21858 │          │        │                   │                  │ kernel: geneve: Fix use-after-free in geneve_find_dev().     │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-21858                   │
│                   ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                   │ CVE-2025-21905 │          │        │                   │                  │ kernel: wifi: iwlwifi: limit printed string from FW file     │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-21905                   │
│                   ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                   │ CVE-2025-21919 │          │        │                   │                  │ kernel: sched/fair: Fix potential memory corruption in       │
│                   │                │          │        │                   │                  │ child_cfs_rq_on_list                                         │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-21919                   │
│                   ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                   │ CVE-2025-21920 │          │        │                   │                  │ kernel: vlan: enforce underlying device type                 │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-21920                   │
│                   ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                   │ CVE-2025-21926 │          │        │                   │                  │ kernel: net: gso: fix ownership in __udp_gso_segment         │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-21926                   │
│                   ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                   │ CVE-2025-21928 │          │        │                   │                  │ kernel: HID: intel-ish-hid: Fix use-after-free issue in      │
│                   │                │          │        │                   │                  │ ishtp_hid_remove()                                           │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-21928                   │
│                   ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                   │ CVE-2025-21934 │          │        │                   │                  │ kernel: rapidio: fix an API misues when rio_add_net() fails  │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-21934                   │
│                   ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                   │ CVE-2025-21945 │          │        │                   │                  │ kernel: ksmbd: fix use-after-free in smb2_lock               │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-21945                   │
│                   ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                   │ CVE-2025-21968 │          │        │                   │                  │ kernel: drm/amd/display: Fix slab-use-after-free on          │
│                   │                │          │        │                   │                  │ hdcp_work                                                    │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-21968                   │
│                   ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                   │ CVE-2025-21979 │          │        │                   │                  │ kernel: wifi: cfg80211: cancel wiphy_work before freeing     │
│                   │                │          │        │                   │                  │ wiphy                                                        │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-21979                   │
│                   ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                   │ CVE-2025-21991 │          │        │                   │                  │ kernel: x86/microcode/AMD: Fix out-of-bounds on systems with │
│                   │                │          │        │                   │                  │ CPU-less NUMA nodes                                          │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-21991                   │
│                   ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                   │ CVE-2025-21993 │          │        │                   │                  │ kernel: iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in │
│                   │                │          │        │                   │                  │ ibft_attr_show_nic()                                         │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-21993                   │
├───────────────────┼────────────────┤          │        ├───────────────────┼──────────────────┼──────────────────────────────────────────────────────────────┤
│ perl              │ CVE-2024-56406 │          │        │ 5.36.0-7+deb12u1  │ 5.36.0-7+deb12u2 │ perl: Perl 5.34, 5.36, 5.38 and 5.40 are vulnerable to a     │
│                   │                │          │        │                   │                  │ heap...                                                      │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2024-56406                   │
├───────────────────┤                │          │        │                   │                  │                                                              │
│ perl-base         │                │          │        │                   │                  │                                                              │
│                   │                │          │        │                   │                  │                                                              │
│                   │                │          │        │                   │                  │                                                              │
├───────────────────┤                │          │        │                   │                  │                                                              │
│ perl-modules-5.36 │                │          │        │                   │                  │                                                              │
│                   │                │          │        │                   │                  │                                                              │
│                   │                │          │        │                   │                  │                                                              │
└───────────────────┴────────────────┴──────────┴────────┴───────────────────┴──────────────────┴──────────────────────────────────────────────────────────────┘

Node.js (node-pkg)
==================
Total: 7 (HIGH: 6, CRITICAL: 1)

┌────────────────────────────────────────┬────────────────┬──────────┬────────┬───────────────────┬─────────────────────┬──────────────────────────────────────────────────────────────┐
│                Library                 │ Vulnerability  │ Severity │ Status │ Installed Version │    Fixed Version    │                            Title                             │
├────────────────────────────────────────┼────────────────┼──────────┼────────┼───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ @openzeppelin/contracts (package.json) │ CVE-2021-46320 │ HIGH     │ fixed  │ 3.2.0             │ 4.4.1               │ Improper Initialization in OpenZeppelin                      │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2021-46320                   │
│                                        ├────────────────┼──────────┤        ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│                                        │ CVE-2021-39167 │ CRITICAL │        │ 3.3.0             │ 4.3.1, 3.4.2        │ TimelockController vulnerability in OpenZeppelin Contracts   │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2021-39167                   │
│                                        ├────────────────┼──────────┤        │                   ├─────────────────────┼──────────────────────────────────────────────────────────────┤
│                                        │ CVE-2021-46320 │ HIGH     │        │                   │ 4.4.1               │ Improper Initialization in OpenZeppelin                      │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2021-46320                   │
├────────────────────────────────────────┼────────────────┤          │        ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ axios (package.json)                   │ CVE-2025-27152 │          │        │ 0.21.4            │ 1.8.2, 0.30.0       │ axios: Possible SSRF and Credential Leakage via Absolute URL │
│                                        │                │          │        │                   │                     │ in axios Requests...                                         │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2025-27152                   │
├────────────────────────────────────────┼────────────────┤          │        ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ cross-spawn (package.json)             │ CVE-2024-21538 │          │        │ 7.0.3             │ 7.0.5, 6.0.6        │ cross-spawn: regular expression denial of service            │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2024-21538                   │
│                                        │                │          │        │                   │                     │                                                              │
│                                        │                │          │        │                   │                     │                                                              │
│                                        │                │          │        │                   │                     │                                                              │
├────────────────────────────────────────┼────────────────┤          │        ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ semver (package.json)                  │ CVE-2022-25883 │          │        │ 7.3.5             │ 7.5.2, 6.3.1, 5.7.2 │ nodejs-semver: Regular expression denial of service          │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2022-25883                   │
└────────────────────────────────────────┴────────────────┴──────────┴────────┴───────────────────┴─────────────────────┴──────────────────────────────────────────────────────────────┘

Copy link

🔒 Trivy Security Scan Results

Click to expand detailed results

For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://aquasecurity.github.io/trivy/v0.57/docs/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


vuln-image.tar (debian 12.10)
=============================
Total: 23 (HIGH: 23, CRITICAL: 0)

┌───────────────────┬────────────────┬──────────┬────────┬───────────────────┬──────────────────┬──────────────────────────────────────────────────────────────┐
│      Library      │ Vulnerability  │ Severity │ Status │ Installed Version │  Fixed Version   │                            Title                             │
├───────────────────┼────────────────┼──────────┼────────┼───────────────────┼──────────────────┼──────────────────────────────────────────────────────────────┤
│ libperl5.36       │ CVE-2024-56406 │ HIGH     │ fixed  │ 5.36.0-7+deb12u1  │ 5.36.0-7+deb12u2 │ perl: Perl 5.34, 5.36, 5.38 and 5.40 are vulnerable to a     │
│                   │                │          │        │                   │                  │ heap...                                                      │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2024-56406                   │
├───────────────────┼────────────────┤          │        ├───────────────────┼──────────────────┼──────────────────────────────────────────────────────────────┤
│ linux-libc-dev    │ CVE-2024-26982 │          │        │ 6.1.129-1         │ 6.1.133-1        │ kernel: Squashfs: check the inode number is not the invalid  │
│                   │                │          │        │                   │                  │ value of...                                                  │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2024-26982                   │
│                   ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                   │ CVE-2024-35866 │          │        │                   │                  │ kernel: smb: client: fix potential UAF in                    │
│                   │                │          │        │                   │                  │ cifs_dump_full_key()                                         │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2024-35866                   │
│                   ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                   │ CVE-2024-50246 │          │        │                   │                  │ kernel: fs/ntfs3: Add rough attr alloc_size check            │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2024-50246                   │
│                   ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                   │ CVE-2024-53166 │          │        │                   │                  │ kernel: block, bfq: fix bfqq uaf in bfq_limit_depth()        │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2024-53166                   │
│                   ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                   │ CVE-2024-58002 │          │        │                   │                  │ kernel: media: uvcvideo: Remove dangling pointers            │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2024-58002                   │
│                   ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                   │ CVE-2025-21702 │          │        │                   │                  │ kernel: pfifo_tail_enqueue: Drop new packet when sch->limit  │
│                   │                │          │        │                   │                  │ == 0                                                         │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-21702                   │
│                   ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                   │ CVE-2025-21855 │          │        │                   │                  │ kernel: ibmvnic: Don't reference skb after sending to VIOS   │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-21855                   │
│                   ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                   │ CVE-2025-21858 │          │        │                   │                  │ kernel: geneve: Fix use-after-free in geneve_find_dev().     │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-21858                   │
│                   ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                   │ CVE-2025-21905 │          │        │                   │                  │ kernel: wifi: iwlwifi: limit printed string from FW file     │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-21905                   │
│                   ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                   │ CVE-2025-21919 │          │        │                   │                  │ kernel: sched/fair: Fix potential memory corruption in       │
│                   │                │          │        │                   │                  │ child_cfs_rq_on_list                                         │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-21919                   │
│                   ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                   │ CVE-2025-21920 │          │        │                   │                  │ kernel: vlan: enforce underlying device type                 │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-21920                   │
│                   ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                   │ CVE-2025-21926 │          │        │                   │                  │ kernel: net: gso: fix ownership in __udp_gso_segment         │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-21926                   │
│                   ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                   │ CVE-2025-21928 │          │        │                   │                  │ kernel: HID: intel-ish-hid: Fix use-after-free issue in      │
│                   │                │          │        │                   │                  │ ishtp_hid_remove()                                           │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-21928                   │
│                   ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                   │ CVE-2025-21934 │          │        │                   │                  │ kernel: rapidio: fix an API misues when rio_add_net() fails  │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-21934                   │
│                   ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                   │ CVE-2025-21945 │          │        │                   │                  │ kernel: ksmbd: fix use-after-free in smb2_lock               │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-21945                   │
│                   ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                   │ CVE-2025-21968 │          │        │                   │                  │ kernel: drm/amd/display: Fix slab-use-after-free on          │
│                   │                │          │        │                   │                  │ hdcp_work                                                    │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-21968                   │
│                   ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                   │ CVE-2025-21979 │          │        │                   │                  │ kernel: wifi: cfg80211: cancel wiphy_work before freeing     │
│                   │                │          │        │                   │                  │ wiphy                                                        │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-21979                   │
│                   ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                   │ CVE-2025-21991 │          │        │                   │                  │ kernel: x86/microcode/AMD: Fix out-of-bounds on systems with │
│                   │                │          │        │                   │                  │ CPU-less NUMA nodes                                          │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-21991                   │
│                   ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                   │ CVE-2025-21993 │          │        │                   │                  │ kernel: iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in │
│                   │                │          │        │                   │                  │ ibft_attr_show_nic()                                         │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-21993                   │
├───────────────────┼────────────────┤          │        ├───────────────────┼──────────────────┼──────────────────────────────────────────────────────────────┤
│ perl              │ CVE-2024-56406 │          │        │ 5.36.0-7+deb12u1  │ 5.36.0-7+deb12u2 │ perl: Perl 5.34, 5.36, 5.38 and 5.40 are vulnerable to a     │
│                   │                │          │        │                   │                  │ heap...                                                      │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2024-56406                   │
├───────────────────┤                │          │        │                   │                  │                                                              │
│ perl-base         │                │          │        │                   │                  │                                                              │
│                   │                │          │        │                   │                  │                                                              │
│                   │                │          │        │                   │                  │                                                              │
├───────────────────┤                │          │        │                   │                  │                                                              │
│ perl-modules-5.36 │                │          │        │                   │                  │                                                              │
│                   │                │          │        │                   │                  │                                                              │
│                   │                │          │        │                   │                  │                                                              │
└───────────────────┴────────────────┴──────────┴────────┴───────────────────┴──────────────────┴──────────────────────────────────────────────────────────────┘

Node.js (node-pkg)
==================
Total: 7 (HIGH: 6, CRITICAL: 1)

┌────────────────────────────────────────┬────────────────┬──────────┬────────┬───────────────────┬─────────────────────┬──────────────────────────────────────────────────────────────┐
│                Library                 │ Vulnerability  │ Severity │ Status │ Installed Version │    Fixed Version    │                            Title                             │
├────────────────────────────────────────┼────────────────┼──────────┼────────┼───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ @openzeppelin/contracts (package.json) │ CVE-2021-46320 │ HIGH     │ fixed  │ 3.2.0             │ 4.4.1               │ Improper Initialization in OpenZeppelin                      │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2021-46320                   │
│                                        ├────────────────┼──────────┤        ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│                                        │ CVE-2021-39167 │ CRITICAL │        │ 3.3.0             │ 4.3.1, 3.4.2        │ TimelockController vulnerability in OpenZeppelin Contracts   │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2021-39167                   │
│                                        ├────────────────┼──────────┤        │                   ├─────────────────────┼──────────────────────────────────────────────────────────────┤
│                                        │ CVE-2021-46320 │ HIGH     │        │                   │ 4.4.1               │ Improper Initialization in OpenZeppelin                      │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2021-46320                   │
├────────────────────────────────────────┼────────────────┤          │        ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ axios (package.json)                   │ CVE-2025-27152 │          │        │ 0.21.4            │ 1.8.2, 0.30.0       │ axios: Possible SSRF and Credential Leakage via Absolute URL │
│                                        │                │          │        │                   │                     │ in axios Requests...                                         │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2025-27152                   │
├────────────────────────────────────────┼────────────────┤          │        ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ cross-spawn (package.json)             │ CVE-2024-21538 │          │        │ 7.0.3             │ 7.0.5, 6.0.6        │ cross-spawn: regular expression denial of service            │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2024-21538                   │
│                                        │                │          │        │                   │                     │                                                              │
│                                        │                │          │        │                   │                     │                                                              │
│                                        │                │          │        │                   │                     │                                                              │
├────────────────────────────────────────┼────────────────┤          │        ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ semver (package.json)                  │ CVE-2022-25883 │          │        │ 7.3.5             │ 7.5.2, 6.3.1, 5.7.2 │ nodejs-semver: Regular expression denial of service          │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2022-25883                   │
└────────────────────────────────────────┴────────────────┴──────────┴────────┴───────────────────┴─────────────────────┴──────────────────────────────────────────────────────────────┘

* refactor: update CI workflow to include health checks and integration tests, remove obsolete Jenkinsfile

* fix: update fork URL and block number retrieval in CI workflow

* fix: update command options and environment variable retrieval in CI workflow

* fix: correct health check options and update fork URL retrieval in CI workflow

* fix: update IPFS image and health check commands in CI workflow

* fix: update CI workflow to include genesis block retrieval and health checks for Graph Node

* fix: update IPFS image to use kubo version in docker-compose

* fix: retrieve fork URL and block number

* fix: remove blockchain-fork service configuration from CI workflow

* fix: update fetch block number to use static values and add IPFS readiness check

* fix: remove code generation step from README

* fix: remove unused services and streamline CI workflow

* fix: update FORK_URL to use the correct endpoint for integration tests

* fix: uncomment steps for installing dependencies, checking format, building, and running unit tests in CI workflow

* fix: uncomment steps for preparing local stack environment and update FORK_BLOCK in test environment setup

* fix: update fetch block step to source environment variables and use dynamic values for FORK_URL and FORK_BLOCK

* fix: add NETWORK_NAME environment variable to prepare local stack environment step

* fix: update fetch block step to source the correct environment file

* fix: remove .idea directory from .gitignore

* fix: reorder build step to occur before running unit tests

* fix: reorder steps to run unit tests after build in CI workflow

* fix: move NETWORK_NAME environment variable to the job level in CI workflow

* Update test-stack/prepare-test-env.ts

Co-authored-by: Zied Guesmi <26070035+zguesmi@users.noreply.github.com>

* fix: update changelog for integration tests migration to GitHub Actions

* fix: streamline test stack preparation in CI workflow (#46)

* fix: remove NETWORK_NAME environment variable from job level in CI workflow

* fix: update .env generation message in prepare-test-env script

* fix: update integration test structure and add .env.template file

* fix: add missing network configurations for avalancheFuji and arbitrumSepolia

* fix: add Arbitrum & Avalanche network to changelog

* fix: add dotenv and zod to package.json and package-lock.json; create env.ts for environment variable validation

* fix: update test:unit script to include 'unit' argument for clarity

* fix: update startBlock values and rename avalancheFuji to fuji in networks.json

* feat: add Protocol entity to Core data source in subgraph.yaml

* fix: update test:e2e script to specify test file pattern

* fix: downgrade @graphprotocol/graph-ts to version 0.35.1 in package.json and package-lock.json

* feat: add dotenv-cli dependency and update build scripts to use dotenv

---------

Co-authored-by: Ugo Mignon <ugo.mignon@gameverse.app>
Co-authored-by: Zied Guesmi <26070035+zguesmi@users.noreply.github.com>
Copy link

🔒 Trivy Security Scan Results

Click to expand detailed results

For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://aquasecurity.github.io/trivy/v0.57/docs/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


vuln-image.tar (debian 12.10)
=============================
Total: 0 (HIGH: 0, CRITICAL: 0)


Node.js (node-pkg)
==================
Total: 7 (HIGH: 6, CRITICAL: 1)

┌────────────────────────────────────────┬────────────────┬──────────┬────────┬───────────────────┬─────────────────────┬──────────────────────────────────────────────────────────────┐
│                Library                 │ Vulnerability  │ Severity │ Status │ Installed Version │    Fixed Version    │                            Title                             │
├────────────────────────────────────────┼────────────────┼──────────┼────────┼───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ @openzeppelin/contracts (package.json) │ CVE-2021-46320 │ HIGH     │ fixed  │ 3.2.0             │ 4.4.1               │ Improper Initialization in OpenZeppelin                      │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2021-46320                   │
│                                        ├────────────────┼──────────┤        ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│                                        │ CVE-2021-39167 │ CRITICAL │        │ 3.3.0             │ 4.3.1, 3.4.2        │ TimelockController vulnerability in OpenZeppelin Contracts   │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2021-39167                   │
│                                        ├────────────────┼──────────┤        │                   ├─────────────────────┼──────────────────────────────────────────────────────────────┤
│                                        │ CVE-2021-46320 │ HIGH     │        │                   │ 4.4.1               │ Improper Initialization in OpenZeppelin                      │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2021-46320                   │
├────────────────────────────────────────┼────────────────┤          │        ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ axios (package.json)                   │ CVE-2025-27152 │          │        │ 0.21.4            │ 1.8.2, 0.30.0       │ axios: Possible SSRF and Credential Leakage via Absolute URL │
│                                        │                │          │        │                   │                     │ in axios Requests...                                         │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2025-27152                   │
├────────────────────────────────────────┼────────────────┤          │        ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ cross-spawn (package.json)             │ CVE-2024-21538 │          │        │ 7.0.3             │ 7.0.5, 6.0.6        │ cross-spawn: regular expression denial of service            │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2024-21538                   │
│                                        │                │          │        │                   │                     │                                                              │
│                                        │                │          │        │                   │                     │                                                              │
│                                        │                │          │        │                   │                     │                                                              │
├────────────────────────────────────────┼────────────────┤          │        ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ semver (package.json)                  │ CVE-2022-25883 │          │        │ 7.3.5             │ 7.5.2, 6.3.1, 5.7.2 │ nodejs-semver: Regular expression denial of service          │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2022-25883                   │
└────────────────────────────────────────┴────────────────┴──────────┴────────┴───────────────────┴─────────────────────┴──────────────────────────────────────────────────────────────┘

@zguesmi zguesmi changed the title feature/setup-agnostic-test-stack-based-on-fork feature: Setup agnostic test stack Apr 29, 2025
@zguesmi zguesmi changed the title feature: Setup agnostic test stack feat: Setup agnostic test stack Apr 29, 2025
@zguesmi
Copy link
Member

zguesmi commented Apr 29, 2025

Merging PR even though the build doesn't seem 100% green, but in reality it is.
It's a only a Github Actions issue, all relevant CI pipeline are ✔️ (test is the old name of build-and-test).
image

@zguesmi zguesmi merged commit 7d9e178 into develop Apr 29, 2025
4 checks passed
@zguesmi zguesmi deleted the feature/setup-agnostique-test-stack-based-on-fork branch April 29, 2025 13:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants