From b81dc5b085aaf84227fb54e064ffaef9de484543 Mon Sep 17 00:00:00 2001 From: Kienan Adams Date: Tue, 14 Jul 2026 16:19:43 -0700 Subject: [PATCH 1/6] fix(deps): refresh OS packages and bump Go to 1.26.5 Refresh the cached Debian apt layer to install patched curl and protobuf packages. Compile the agent and align Go modules with Go 1.26.5 for CVE-2026-39822. Pin npm 11.18.0 because npm 12 no longer supports Node 20. --- agent/go.mod | 2 +- docker/Dockerfile | 8 ++++---- scaffold/go/go.mod | 2 +- sdks/go/go.mod | 2 +- 4 files changed, 7 insertions(+), 7 deletions(-) diff --git a/agent/go.mod b/agent/go.mod index f62468d..7ec0040 100644 --- a/agent/go.mod +++ b/agent/go.mod @@ -1,6 +1,6 @@ module github.com/cortexapps/axon -go 1.26.4 +go 1.26.5 require ( github.com/google/uuid v1.6.0 diff --git a/docker/Dockerfile b/docker/Dockerfile index 743b860..5bb179a 100644 --- a/docker/Dockerfile +++ b/docker/Dockerfile @@ -3,7 +3,7 @@ FROM debian:stable-slim AS builder RUN apt-get update && apt-get upgrade -y && apt-get install -y protobuf-compiler git wget build-essential -ENV GOLANG_VERSION=1.26.4 +ENV GOLANG_VERSION=1.26.5 RUN wget -q "https://dl.google.com/go/go${GOLANG_VERSION}.linux-$(dpkg --print-architecture).tar.gz" -O /tmp/go.tar.gz \ && tar -C /usr/local -xzf /tmp/go.tar.gz \ && rm /tmp/go.tar.gz @@ -27,7 +27,7 @@ WORKDIR /agent # when the scheduled Trivy scan flags OS-package CVEs whose fixes are already # in the archive — the cache is just serving a stale layer. Leaves the rest of # the build (Go, npm, snyk-broker clone) hitting cache as normal. -ARG APT_CACHE_BUST=2026-07-07 +ARG APT_CACHE_BUST=2026-07-14 RUN echo "apt cache bust: $APT_CACHE_BUST" \ && apt-get update && apt-get upgrade -y && apt-get install -y \ protobuf-compiler git python3 python3-venv wget build-essential openssl jq @@ -37,7 +37,7 @@ ENV NODE_VERSION=20 ARG SNYK_BROKER_VERSION=v1.0.16-axon RUN wget -q -O - https://deb.nodesource.com/setup_${NODE_VERSION}.x | bash - && apt-get install -y nodejs -RUN npm install --global npm@latest typescript@4.9.3 +RUN npm install --global npm@11.18.0 typescript@4.9.3 RUN git clone https://github.com/cortexapps/snyk-broker.git /tmp/snyk-broker && \ cd /tmp/snyk-broker && \ git checkout ${SNYK_BROKER_VERSION} && \ @@ -52,7 +52,7 @@ RUN git clone https://github.com/cortexapps/snyk-broker.git /tmp/snyk-broker && ENV PATH="/usr/local/lib/node_modules/.bin:${PATH}" # Install Go (needed by scaffold apps that build on top of this image) -ENV GOLANG_VERSION=1.26.4 +ENV GOLANG_VERSION=1.26.5 RUN wget -q "https://dl.google.com/go/go${GOLANG_VERSION}.linux-$(dpkg --print-architecture).tar.gz" -O /tmp/go.tar.gz \ && tar -C /usr/local -xzf /tmp/go.tar.gz \ && rm /tmp/go.tar.gz diff --git a/scaffold/go/go.mod b/scaffold/go/go.mod index 3f74d64..a1d96e3 100644 --- a/scaffold/go/go.mod +++ b/scaffold/go/go.mod @@ -1,6 +1,6 @@ module github.com/cortexapps/axon_apps/{{.ProjectName}} -go 1.26.4 +go 1.26.5 require ( github.com/google/uuid v1.6.0 diff --git a/sdks/go/go.mod b/sdks/go/go.mod index 27a66b7..fff9e2f 100644 --- a/sdks/go/go.mod +++ b/sdks/go/go.mod @@ -1,6 +1,6 @@ module github.com/cortexapps/axon-go -go 1.26.4 +go 1.26.5 require ( github.com/google/uuid v1.6.0 From 5a8151f41605f542bccea6908e37e18ddbeb89cd Mon Sep 17 00:00:00 2001 From: Kienan Adams Date: Tue, 14 Jul 2026 16:27:01 -0700 Subject: [PATCH 2/6] fix(ci): align Trivy PR severity filtering Filter PR SARIF results to error-level findings before counting and printing them, matching the scheduled Trivy workflow and the HIGH/CRITICAL enforcement established in #94. --- .github/workflows/docker.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml index 5618d14..3930d99 100644 --- a/.github/workflows/docker.yml +++ b/.github/workflows/docker.yml @@ -121,10 +121,10 @@ jobs: - name: Fail on CRITICAL/HIGH vulnerabilities run: | - COUNT=$(jq '[.runs[].results[]] | length' trivy-results.sarif) + COUNT=$(jq '[.runs[].results[] | select(.level == "error")] | length' trivy-results.sarif) if [ "$COUNT" -gt 0 ]; then echo "::error::Found $COUNT CRITICAL/HIGH fixable vulnerabilities:" - jq -r '.runs[].results[] | "\(.ruleId): \(.message.text | split("\n") | .[0])"' trivy-results.sarif + jq -r '.runs[].results[] | select(.level == "error") | "\(.ruleId): \(.message.text | split("\n") | .[0])"' trivy-results.sarif exit 1 fi From 837069770f8907355f84ce289d928296dd60d53e Mon Sep 17 00:00:00 2001 From: Kienan Adams Date: Tue, 14 Jul 2026 16:32:55 -0700 Subject: [PATCH 3/6] fix(deps): bump x/net and x/text for Trivy CVEs Upgrade golang.org/x/net to v0.56.0 for CVE-2026-46600 and golang.org/x/text to v0.39.0 for CVE-2026-56852. The module solver also advances golang.org/x/sys to v0.46.0. --- agent/go.mod | 6 +++--- agent/go.sum | 6 ++++++ 2 files changed, 9 insertions(+), 3 deletions(-) diff --git a/agent/go.mod b/agent/go.mod index 7ec0040..4ddd335 100644 --- a/agent/go.mod +++ b/agent/go.mod @@ -30,9 +30,9 @@ require ( github.com/prometheus/procfs v0.15.1 // indirect go.uber.org/dig v1.18.0 // indirect go.uber.org/multierr v1.11.0 // indirect - golang.org/x/net v0.55.0 // indirect - golang.org/x/sys v0.45.0 // indirect - golang.org/x/text v0.37.0 // indirect + golang.org/x/net v0.56.0 // indirect + golang.org/x/sys v0.46.0 // indirect + golang.org/x/text v0.39.0 // indirect google.golang.org/genproto/googleapis/rpc v0.0.0-20251202230838-ff82c1b0f217 // indirect gopkg.in/yaml.v3 v3.0.1 // indirect ) diff --git a/agent/go.sum b/agent/go.sum index 0a3a751..273948a 100644 --- a/agent/go.sum +++ b/agent/go.sum @@ -80,14 +80,20 @@ golang.org/x/net v0.51.0 h1:94R/GTO7mt3/4wIKpcR5gkGmRLOuE/2hNGeWq/GBIFo= golang.org/x/net v0.51.0/go.mod h1:aamm+2QF5ogm02fjy5Bb7CQ0WMt1/WVM7FtyaTLlA9Y= golang.org/x/net v0.55.0 h1:bcvxaJn3e1U6InsFWt1JUq1aSjnRxLzT2rtD2KfkDF8= golang.org/x/net v0.55.0/go.mod h1:L5U2KuzuOe1lY7Z+aWVIKK6qEeJXnXV9yzGA+WCHJww= +golang.org/x/net v0.56.0 h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o= +golang.org/x/net v0.56.0/go.mod h1:D3Ku6r+V6JROoZK144D2XfMHFcMq/0zSfLelVTCFKec= golang.org/x/sys v0.41.0 h1:Ivj+2Cp/ylzLiEU89QhWblYnOE9zerudt9Ftecq2C6k= golang.org/x/sys v0.41.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks= golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY= golang.org/x/sys v0.45.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= +golang.org/x/sys v0.46.0 h1:noSf2Fq6F8DBgS+LysIkx7rIExoNHJsxOAtPp4rthXw= +golang.org/x/sys v0.46.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= golang.org/x/text v0.34.0 h1:oL/Qq0Kdaqxa1KbNeMKwQq0reLCCaFtqu2eNuSeNHbk= golang.org/x/text v0.34.0/go.mod h1:homfLqTYRFyVYemLBFl5GgL/DWEiH5wcsQ5gSh1yziA= golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc= golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38= +golang.org/x/text v0.39.0 h1:UbZz4pLOvn600D6Oh6GGEI6VAmndrEBLv8/6BEXzyus= +golang.org/x/text v0.39.0/go.mod h1:3UwRclnC2g0TU9x8PZiyfOajCd1zaUNHF9cvqcQZ+ZM= gonum.org/v1/gonum v0.16.0 h1:5+ul4Swaf3ESvrOnidPp4GZbzf0mxVQpDCYUQE7OJfk= gonum.org/v1/gonum v0.16.0/go.mod h1:fef3am4MQ93R2HHpKnLk4/Tbh/s0+wqD5nfa6Pnwy4E= google.golang.org/genproto/googleapis/rpc v0.0.0-20251202230838-ff82c1b0f217 h1:gRkg/vSppuSQoDjxyiGfN4Upv/h/DQmIR10ZU8dh4Ww= From 67278719e3839cc1d907896feb9478037da28aa1 Mon Sep 17 00:00:00 2001 From: Kienan Adams Date: Tue, 14 Jul 2026 16:40:10 -0700 Subject: [PATCH 4/6] fix(test): pin npm for relay image Keep the Snyk broker relay fixture on npm 11.18.0 so it remains compatible with the image's Node 20 runtime. --- agent/test/relay/Dockerfile.snyk-broker-server | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/agent/test/relay/Dockerfile.snyk-broker-server b/agent/test/relay/Dockerfile.snyk-broker-server index cc51140..23e2bdd 100644 --- a/agent/test/relay/Dockerfile.snyk-broker-server +++ b/agent/test/relay/Dockerfile.snyk-broker-server @@ -6,7 +6,7 @@ ARG SNYK_BROKER_VERSION=v1.0.6-axon RUN apt update && apt install -y git wget && \ wget -q -O - https://deb.nodesource.com/setup_${NODE_VERSION}.x | bash - && \ apt install -y nodejs && \ - npm install --global npm@latest typescript@4.9.3 + npm install --global npm@11.18.0 typescript@4.9.3 RUN git clone https://github.com/cortexapps/snyk-broker.git /tmp/snyk-broker && \ cd /tmp/snyk-broker && \ From 91fef127511bb6bfb62fc390980be495f3ea9357 Mon Sep 17 00:00:00 2001 From: Kienan Adams Date: Tue, 14 Jul 2026 16:46:00 -0700 Subject: [PATCH 5/6] fix(deps): move broker images to Node 22 Node 20 is end-of-life. Move the production and relay-test broker images to the supported Node 22 LTS line while retaining the npm pin for reproducible builds. --- agent/test/relay/Dockerfile.snyk-broker-server | 2 +- docker/Dockerfile | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/agent/test/relay/Dockerfile.snyk-broker-server b/agent/test/relay/Dockerfile.snyk-broker-server index 23e2bdd..45851a4 100644 --- a/agent/test/relay/Dockerfile.snyk-broker-server +++ b/agent/test/relay/Dockerfile.snyk-broker-server @@ -1,7 +1,7 @@ FROM debian:stable-slim # Install NodeJS and Snyk Broker -ENV NODE_VERSION=20 +ENV NODE_VERSION=22 ARG SNYK_BROKER_VERSION=v1.0.6-axon RUN apt update && apt install -y git wget && \ wget -q -O - https://deb.nodesource.com/setup_${NODE_VERSION}.x | bash - && \ diff --git a/docker/Dockerfile b/docker/Dockerfile index 5bb179a..1277a23 100644 --- a/docker/Dockerfile +++ b/docker/Dockerfile @@ -33,7 +33,7 @@ RUN echo "apt cache bust: $APT_CACHE_BUST" \ protobuf-compiler git python3 python3-venv wget build-essential openssl jq # Install NodeJS and Snyk Broker -ENV NODE_VERSION=20 +ENV NODE_VERSION=22 ARG SNYK_BROKER_VERSION=v1.0.16-axon RUN wget -q -O - https://deb.nodesource.com/setup_${NODE_VERSION}.x | bash - && apt-get install -y nodejs From 8e505ddd785b3b7693c24dc0b0862cba8b8d86aa Mon Sep 17 00:00:00 2001 From: Kienan Adams Date: Tue, 14 Jul 2026 17:02:50 -0700 Subject: [PATCH 6/6] chore(deps): keep broker images on Node 20 Limit this PR to the vulnerability and reproducibility fixes. Defer the Node runtime-major migration to a dedicated change with focused compatibility testing. --- agent/test/relay/Dockerfile.snyk-broker-server | 2 +- docker/Dockerfile | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/agent/test/relay/Dockerfile.snyk-broker-server b/agent/test/relay/Dockerfile.snyk-broker-server index 45851a4..23e2bdd 100644 --- a/agent/test/relay/Dockerfile.snyk-broker-server +++ b/agent/test/relay/Dockerfile.snyk-broker-server @@ -1,7 +1,7 @@ FROM debian:stable-slim # Install NodeJS and Snyk Broker -ENV NODE_VERSION=22 +ENV NODE_VERSION=20 ARG SNYK_BROKER_VERSION=v1.0.6-axon RUN apt update && apt install -y git wget && \ wget -q -O - https://deb.nodesource.com/setup_${NODE_VERSION}.x | bash - && \ diff --git a/docker/Dockerfile b/docker/Dockerfile index 1277a23..5bb179a 100644 --- a/docker/Dockerfile +++ b/docker/Dockerfile @@ -33,7 +33,7 @@ RUN echo "apt cache bust: $APT_CACHE_BUST" \ protobuf-compiler git python3 python3-venv wget build-essential openssl jq # Install NodeJS and Snyk Broker -ENV NODE_VERSION=22 +ENV NODE_VERSION=20 ARG SNYK_BROKER_VERSION=v1.0.16-axon RUN wget -q -O - https://deb.nodesource.com/setup_${NODE_VERSION}.x | bash - && apt-get install -y nodejs