chore(deps): bump the aspnet runtime base image to .NET 10.0.11 - #518
Merged
Conversation
CVE-2026-62901 is a HIGH-severity .NET denial-of-service advisory against Microsoft.NETCore.App.Runtime.linux-x64 10.0.10, fixed in 10.0.11. The pinned aspnet:10.0 digest carried 10.0.10, so the Trivy gate began failing every PR once the advisory landed -- correctly, since the fix exists and the gate only blocks on FIXABLE findings. Nothing about the image changed; the vulnerability database did. main was green on 2026-08-11 and every run since is red on this job, including PRs whose diffs touch no Dockerfile at all. The new pin is the multi-arch INDEX digest, per the policy comment at the top of this file -- taken from the registry's manifest-list content digest, not from a single-architecture manifest. Verified locally before pushing: the built image reports Microsoft.NETCore.App/10.0.11 and Microsoft.AspNetCore.App/10.0.11, and Trivy at the CI settings reports zero fixable HIGH/CRITICAL findings. Only the runtime stage is bumped. The SDK stage is build-only and is discarded before the final image, so it is outside what the scan examines; leaving it pinned keeps this diff to the one line the CVE requires.
This was referenced Aug 12, 2026
mforce
added a commit
that referenced
this pull request
Aug 13, 2026
The NuGet half of the #146 vulnerability gate is failing on main: [nuget] high - SSH.NET@2025.1.0 - GHSA-q939-rpr3-3284 - transitive [nuget] 1 advisory at or above "high". GHSA-q939-rpr3-3284 is high severity: ScpClient's recursive download honours server-controlled SCP filenames, allowing an arbitrary file write. Affected range is <= 2025.1.0; fixed in 2026.0.0. SSH.NET arrives transitively through Testcontainers 4.13.0, which is the latest release and still declares SSH.NET 2025.1.0. So Dependabot has nothing to propose here, and no amount of re-running the update job would produce a PR - lifting the resolved version needs a direct reference in the consuming project, which is what this commit adds. Scope of the exposure: Cluckwork never calls ScpClient. Testcontainers reaches SSH.NET only for remote/SSH Docker hosts, and the fixtures use a local daemon. The dependency is also test-only. This is gate hygiene rather than a live vulnerability - but the gate scans transitives and fails closed, so it blocks every unrelated PR until the resolved version moves. Lock files were regenerated solution-wide so all five agree, since CI restores with --locked-mode. Collateral from the floating version ranges re-resolving, all patch or minor: - ASP.NET Core / EF Core 10.0.10 -> 10.0.11 - Newtonsoft.Json 13.0.3 -> 13.0.4 - BouncyCastle.Cryptography 2.6.2 -> 2.7.0 (required by SSH.NET 2026.0.0) The runtime base image already moved to 10.0.11 in #518, so the managed packages now match it. Verified: - dotnet build Cluckwork.sln - 0 warnings, 0 errors - dotnet test Cluckwork.sln - 1637 passed, 0 failed (1167 integration tests against real Testcontainers/Docker, which is what exercises SSH.NET 2026.0.0 at runtime) - the gate itself: dotnet list package --vulnerable --include-transitive piped through .github/scripts/vuln-gate.mjs now reports 'no advisories at or above "high" (0 excepted, 0 below threshold)' and exits 0 Co-authored-by: mforce <>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Unblocks CI on every open PR, including #516 and #517.
What broke
CVE-2026-62901— a HIGH-severity .NET denial-of-service advisory againstMicrosoft.NETCore.App.Runtime.linux-x6410.0.10, fixed in 10.0.11. Thepinned
aspnet:10.0digest carried 10.0.10, so the Trivy gate started failing —correctly. It blocks only on fixable HIGH/CRITICAL findings, and a fix exists.
Nothing about the image changed; the vulnerability database did.
mainwasgreen on 2026-08-11 at 16:56, and every run since is red on this job — including
PRs whose diffs touch no
Dockerfileand no workflow. #516 and #517 both fail itidentically, which is what ruled either of them out as the cause.
No Dependabot PR had opened for it yet.
The change
One line: the runtime base pin moves to
sha256:207cc51496778557731c81ff670333d8ade4a4fec22768fd1be8e78474a84ecf.That is the multi-arch index digest, per the policy comment at the top of the
file — read from the registry's manifest-list content digest
(
content-type: application/vnd.docker.distribution.manifest.list.v2+json),not from a single-architecture manifest. Pinning an arch-specific digest here
would quietly break the other architecture.
Only the runtime stage moves. The SDK stage is build-only and discarded before
the final image, so it is outside what the scan examines; leaving it pinned keeps
this to the one line the CVE requires.
Verified before pushing
Built the image from this branch and scanned it locally at the CI settings
(
--severity HIGH,CRITICAL --ignore-unfixed):Microsoft.NETCore.App/**10.0.11**andMicrosoft.AspNetCore.App/**10.0.11**0— against 1 HIGH on the current pin.