fix(deps): refresh OS packages and bump Go to 1.26.5 - #114
Merged
Conversation
Refresh the cached Debian apt layer to install patched curl and protobuf packages. Compile the agent and align Go modules with Go 1.26.5 for CVE-2026-39822. Pin npm 11.18.0 because npm 12 no longer supports Node 20.
Filter PR SARIF results to error-level findings before counting and printing them, matching the scheduled Trivy workflow and the HIGH/CRITICAL enforcement established in #94.
Upgrade golang.org/x/net to v0.56.0 for CVE-2026-46600 and golang.org/x/text to v0.39.0 for CVE-2026-56852. The module solver also advances golang.org/x/sys to v0.46.0.
Keep the Snyk broker relay fixture on npm 11.18.0 so it remains compatible with the image's Node 20 runtime.
Node 20 is end-of-life. Move the production and relay-test broker images to the supported Node 22 LTS line while retaining the npm pin for reproducible builds.
quicksnap
added a commit
that referenced
this pull request
Jul 14, 2026
## Claude description > CI `build` and `docker-tests` jobs fail on any branch since npm@12.0.1 > released: both broker images run `npm install --global npm@latest` on > Node 20, and npm 12 requires Node >= 22.22.2 (EBADENGINE). Unrelated to > the Harness change on this branch. > > Mirrors the fix from PR #114 exactly so the branches merge cleanly: > `NODE_VERSION` 20 -> 22 and `npm@latest` -> `npm@11.18.0` in > `docker/Dockerfile` and `agent/test/relay/Dockerfile.snyk-broker-server`. > > Verified locally: `make docker-build` and a direct build of > `Dockerfile.snyk-broker-server` both complete; `go build ./...` and > `go test ./...` still pass. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Limit this PR to the vulnerability and reproducibility fixes. Defer the Node runtime-major migration to a dedicated change with focused compatibility testing.
ashiramin
approved these changes
Jul 15, 2026
quicksnap
added a commit
that referenced
this pull request
Jul 15, 2026
* [DAT-707] Add Harness integration support to the relay agent
## Claude description
> Registers `harness` as a valid relay integration and adds its accept
> file, the first one to authenticate via header injection instead of
> basic/bearer `auth`: the route sends `any /*` to `${HARNESS_API}` and
> injects `x-api-key` from `${HARNESS_TOKEN}` through the accept-file
> `headers` mechanism (requires reflector traffic mode, the default).
>
> Adds `config.harness.json` with a `GET $HARNESS_API/ng/api/user/currentUser`
> credential-validation endpoint; the final endpoint choice is being
> verified in brain-backend work (DAT-708). Note the broker systemcheck
> can only send validation credentials in the `Authorization` header
> today, so this validation will not authenticate against Harness until
> the broker fork supports custom validation header names.
>
> Tests: accept-file load/render + missing-var + validation-config cases
> in `common`, and a live reflector test proving the shipped accept file
> injects `x-api-key` on proxied requests and that an inbound placeholder
> `x-api-key` is replaced rather than duplicated.
>
> Also lists Harness in both READMEs.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* [DAT-707] Pin npm and move broker images to Node 22 to fix image builds
## Claude description
> CI `build` and `docker-tests` jobs fail on any branch since npm@12.0.1
> released: both broker images run `npm install --global npm@latest` on
> Node 20, and npm 12 requires Node >= 22.22.2 (EBADENGINE). Unrelated to
> the Harness change on this branch.
>
> Mirrors the fix from PR #114 exactly so the branches merge cleanly:
> `NODE_VERSION` 20 -> 22 and `npm@latest` -> `npm@11.18.0` in
> `docker/Dockerfile` and `agent/test/relay/Dockerfile.snyk-broker-server`.
>
> Verified locally: `make docker-build` and a direct build of
> `Dockerfile.snyk-broker-server` both complete; `go build ./...` and
> `go test ./...` still pass.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
APT_CACHE_BUSTfrom2026-07-07to2026-07-14so the runtime image installs current Debian security updates.golang.org/x/netandgolang.org/x/textmodules to their patched releases.npm@latestin both the production and relay-test images.level == "error", matching the scheduled workflow's HIGH/CRITICAL enforcement.Why
The scheduled Trivy scan started failing with 17 fixable HIGH findings across five unique CVEs:
The Debian fixes are already available in stable, so this follows the cache-refresh mechanism established in #104 and used most recently in #112. The Go change follows #108 by updating both compiler installations and the matching module directives.
The first PR image scan then surfaced two additional HIGH findings embedded in the compiled agent: CVE-2026-46600 in
golang.org/x/netand CVE-2026-56852 ingolang.org/x/text. The agent now uses the fixed releases, withgolang.org/x/sysmoving to 0.46.0 as the compatible transitive dependency selected by Go.During validation, the refreshed build also exposed that
npm@latestnow resolves to npm 12.0.1, which requires Node 22.22.2 or newer and fails with these images' Node 20.20.2. npm 11.18.0 supports the existing Node runtime, so pinning it fixes both builds reproducibly without including a Node runtime-major migration in this vulnerability PR.The PR scan previously counted every SARIF result even though the scheduled workflow filters to error-level findings following #94. Applying the same filter to both the count and printed findings prevents MEDIUM/LOW entries from blocking PRs without suppressing any current HIGH findings.
Initial failed scan: https://github.com/cortexapps/axon/actions/runs/29328042265
Follow-up scan that identified the Go modules: https://github.com/cortexapps/axon/actions/runs/29375865754/job/87229601715
Verification
docker build --platform linux/arm64 -f docker/Dockerfile -t axon-vuln-pr:local ./agent/cortex-axon-agentreportsgo1.26.5./agent/cortex-axon-agentembedsgolang.org/x/net v0.56.0,golang.org/x/text v0.39.0, andgolang.org/x/sys v0.46.0.8.14.1-2+deb13u4.3.21.12-11+deb13u1.go test ./...insdks/gounder Go 1.26.5.git diff --checkdocker-testsrelay jobs pass with Node 20 and npm 11.18.0.The final PR head's
Run Trivy PR scan (local image)job passed against the complete image, including the HIGH/CRITICAL enforcement step.