Skip to content

Fix: OSV scanner docker/docker CVE#3954

Merged
ponimas merged 9 commits intomasterfrom
fix/osv-scanner-moby-cve
Apr 13, 2026
Merged

Fix: OSV scanner docker/docker CVE#3954
ponimas merged 9 commits intomasterfrom
fix/osv-scanner-moby-cve

Conversation

@szuecs
Copy link
Copy Markdown
Member

@szuecs szuecs commented Apr 8, 2026

  • testcontainers-go depends on docker/docker
  • eopa depends on docker/docker

Both depend only in tests/examples on docker/docker , so CVE is not a vulnerability in skipper binary.

testcontainers-go was fixed testcontainers/testcontainers-go#3591
eopa we are working on a fix open-policy-agent/eopa#370

@szuecs szuecs added the bugfix Bug fixes and patches label Apr 8, 2026
@szuecs szuecs force-pushed the fix/osv-scanner-moby-cve branch from 511a664 to 07277b4 Compare April 9, 2026 20:21
szuecs added 7 commits April 10, 2026 19:10
…ding on old version of moby

Signed-off-by: Sandor Szücs <sandor.szuecs@zalando.de>
Signed-off-by: Sandor Szücs <sandor.szuecs@zalando.de>
Signed-off-by: Sandor Szücs <sandor.szuecs@zalando.de>
Signed-off-by: Sandor Szücs <sandor.szuecs@zalando.de>
Signed-off-by: Sandor Szücs <sandor.szuecs@zalando.de>
Signed-off-by: Sandor Szücs <sandor.szuecs@zalando.de>
Signed-off-by: Sandor Szücs <sandor.szuecs@zalando.de>
@szuecs szuecs force-pushed the fix/osv-scanner-moby-cve branch from aa85e32 to 4cb3e56 Compare April 10, 2026 17:13
Signed-off-by: Sandor Szücs <sandor.szuecs@zalando.de>
@szuecs
Copy link
Copy Markdown
Member Author

szuecs commented Apr 10, 2026

I fail to understand why we have this non-flaky test failure, which I can reproduce in this branch but not in master:

--- FAIL: TestPostProcessor (2.09s)
    --- FAIL: TestPostProcessor/invalid_endpoint_address (0.00s)
        fadein_test.go:189: parse "http://::": invalid port "::" after host
FAIL

Comment thread go.mod
)

go 1.25.8
go 1.26.1
Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this create the test failure

% go test ./filters/fadein -run '^TestPostProcessor$/^invalid_endpoint_address$' -count 1 -v
=== RUN   TestPostProcessor
=== RUN   TestPostProcessor/invalid_endpoint_address
    fadein_test.go:189: parse "http://::": invalid port "::" after host
--- FAIL: TestPostProcessor (0.00s)
    --- FAIL: TestPostProcessor/invalid_endpoint_address (0.00s)
FAIL

issue introduced by Go version update
failure was:
fadein_test.go:189: parse "http://::": invalid port "::" after host

Signed-off-by: Sandor Szücs <sandor.szuecs@zalando.de>
t.Run("invalid endpoint address", func(t *testing.T) {
const routes = `
* -> fadeIn("1m") -> <"http://::">
* -> fadeIn("1m") -> <"http:/::">
Copy link
Copy Markdown
Member Author

@szuecs szuecs Apr 10, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

hack to fail differently, because of Go update to 1.26.1

@szuecs
Copy link
Copy Markdown
Member Author

szuecs commented Apr 10, 2026

👍

1 similar comment
@ponimas
Copy link
Copy Markdown
Member

ponimas commented Apr 13, 2026

👍

@ponimas ponimas merged commit 7be0a5d into master Apr 13, 2026
18 of 21 checks passed
@ponimas ponimas deleted the fix/osv-scanner-moby-cve branch April 13, 2026 08:20
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bugfix Bug fixes and patches

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants