[automation] Auto-update linters version, help and documentation - #8726
Merged
Conversation
github-actions
Bot
requested review from
bdovaz,
echoix and
nvuillam
as code owners
August 16, 2026 22:36
github-actions
Bot
added
dependencies
Contributor
Author
✅
|
github-actions
Bot
force-pushed
the
create-pull-request/patch
branch
4 times, most recently
from
August 20, 2026 22:35
d732052 to
ec83a3e
Compare
github-actions
Bot
force-pushed
the
create-pull-request/patch
branch
from
August 21, 2026 22:43
ec83a3e to
6c15b4b
Compare
…ckets DoS Go stdlib CVE-2026-56853 / 56858 / 56859 / 56860 / 56862 (fixed in go1.26.6) are flagged on every Go binary in the images. Only revive and dustilock are compiled in-repo; the rest come from upstream vendor images already pinned at their latest release, so there is no upgrade path. Four are availability-only and unreachable from a one-shot lint CLI that binds no listener and terminates no TLS; the encoding/xml one is documented as bounded rather than unreachable. CVE-2026-62901 is a System.Net.WebSockets receive-loop hang in the .NET runtime bundled with PowerShell. PowerShell 7.6.5 is still built against SDK 10.0.302 (runtime 10.0.10), so bumping the pin does not clear it. arm-ttk and the powershell linters never open a WebSocket.
…ve; ignore the rest Upgrades that genuinely clear the findings: - GO_IMAGE_VERSION 1.26.5 -> 1.26.7 (go1.26.6 fixes CVE-2026-33818 and CVE-2026-46600), which rebuilds the two binaries MegaLinter compiles itself, revive and dustilock. - golangci-lint 2.12.2 -> 2.13.1 and revive v1.15.0 -> v1.16.0: both vendor the fixed golang.org/x/mod v0.40.0, clearing CVE-2026-56864 and CVE-2026-56865. Ignore entries for what has no upgrade path, each with its justification: - CVE-2026-33818 (encoding/asn1) and CVE-2026-46600 (x/net dns/dnsmessage) for actionlint, shfmt, editorconfig-checker and the other binaries copied from upstream vendor images already pinned at their latest release. - CVE-2026-56864 / CVE-2026-56865 for editorconfig-checker, syft and trivy. The flaw is in x/mod's sumdb / module-proxy client, i.e. the code run while downloading and verifying modules. These tools link x/mod only to parse go.mod and resolve module metadata in a checked-out tree; module downloads during the Docker build use the go toolchain's own copy against the default proxy.golang.org / sum.golang.org.
- CVE-2026-73507 (netty-codec-xml) and CVE-2026-59902 (netty-transport-sctp): an XML wire-protocol decoder and the SCTP transport, bundled in code-analyzer-sfge-engine/dist/java-lib. The Salesforce Graph Engine walks Apex source locally to build a call graph; it opens no socket, speaks no SCTP and decodes no network XML frames. @salesforce/plugin-code-analyzer 5.15.0, which vendors them, is the latest release. - CVE-2026-73566 (node-tar): availability-only DoS on a crafted long-path archive. node-tar runs when sf extracts an archive, which happens while installing plugins at Docker build time, not at lint time.
The good fixture was the stock `helm create` scaffold, which kubescape now fails on two High controls: C-0211 (no security context) and C-0237 (the referenced image carries no signature). kubescape downloads its policies at scan time, so this surfaced without any repository change. The chart is now genuinely well configured rather than merely passing: - pod and container security contexts set (runAsNonRoot, runAsUser/Group, fsGroup, seccompProfile RuntimeDefault, seLinuxOptions, allowPrivilegeEscalation false, readOnlyRootFilesystem, drop ALL capabilities) - added the ServiceAccount template that the scaffold referenced but never defined, with automountServiceAccountToken disabled - added a NetworkPolicy restricting ingress to the container port and egress to DNS - image switched to the cosign-signed cgr.dev/chainguard/nginx, which also runs unprivileged on port 8080 - added an `app` selector label, required by the label-usage control The bad fixture is unchanged and still fails as expected.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
[automation] Auto-update linters version, help and documentation