Repository navigation
feat: update ccache to v4.14.2 - #1480
Ron (rjaegers) wants to merge 5 commits into
Conversation
There was a problem hiding this comment.
Copilot review overview
🟢 Approval recommended
The release exists and all four checksums match its published assets.
Review effort: Balanced
Findings: None
What changed in this PR
Updates ccache in the C++ devcontainer to version 4.14.1.
Changes:
- Bumps
CCACHE_VERSIONto 4.14.1. - Updates verified amd64 and arm64 archive/signature checksums.
| File | Description |
|---|---|
.devcontainer/cpp/Dockerfile |
Updates ccache version and architecture-specific checksums. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
📦 Container Size AnalysisNote Comparing 📈 Size Comparison Table
|
❌MegaLinter analysis: Error
Detailed Issues❌ REPOSITORY / grype - 1 error❌ REPOSITORY / trivy - 1 error
|
| input size | time |
|---|---|
| 12000 | 18ms |
| 24000 | 47ms |
| 48000 | 115ms |
| 96000 | 428ms |
| 192000 | 1586ms |
Patches
Fixed in 15.0.2 and 14.3.2.
Workarounds
Disable typography with typographer: false, or disable only the smartquotes rule:
md.disable('smartquotes')warning: Package 'markdown-it@14.3.1' is vulnerable to 'CVE-2026-111766' (also known as 'GHSA-vfgh-jcmw-g37q').
= CVE-2026-111766: markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled
= ### Summary
With html: true, markdown-it takes quadratic time to parse repeated unterminated HTML constructs inside a paragraph. This affects HTML comments (<!--), processing instructions (<?), declarations (<!A), and CDATA sections (<![CDATA[).
An attacker-controlled input of a few hundred kilobytes can block the Node.js event loop for seconds or tens of seconds. The default configuration has HTML disabled, but the commonmark preset enables it.
The issue was reported against the published markdown-it@15.0.2 package on Node.js 20 and reproduced on the current source with Node.js 24.16.0.
Details
src/rules_inline/text.ts treats < as a terminator, causing the inline parser to attempt the HTML rule at successive HTML construct openers.
With HTML enabled, src/rules_inline/html_inline.ts applies an anchored regular expression to the remaining input:
const match = state.src.slice(pos).match(HTML_TAG_RE)The comment, processing instruction, declaration, and CDATA alternatives in src/common/html_re.ts scan the remaining input for their respective terminators: -->, ?>, >, and ]]>.
When the terminator is absent, matching fails. Parsing eventually reaches the next opener and scans an overlapping suffix again. Repeating this across the paragraph produces quadratic total work. For these inputs, the problem is repeated scanning across separate matches.
The payload must reach inline parsing. Prefixing it with x keeps it inside a paragraph. Starting a line directly with one of these constructs instead invokes HTML block parsing, which does not exhibit the same repeated inline scans for these payloads.
The existing unclosed <!-- test in test/markdown-it/pathological.test.mjs already contains a reproducer:
'</' + '<!--'.repeat(100000)However, it runs with default options, where HTML is disabled.
A fix should avoid repeated searches for absent terminators across all four affected alternatives, for example by caching failed searches on the inline state. Fixing only the comment alternative leaves the other three cases affected. Regression coverage should exercise all four with html: true.
The original report was submitted by @JarLob. It credits the GitHub Security Lab Taskflow Agent as part of the GitHub Secure Open Source Fund.
Proof of concept
Install the affected package in an empty directory:
npm install markdown-it@15.0.2Save the following as poc.mjs and run node poc.mjs:
import MarkdownIt from 'markdown-it'
import { performance } from 'node:perf_hooks'
const mdHtml = new MarkdownIt({ html: true })
const mdDefault = new MarkdownIt()
const sizes = [8000, 16000, 32000, 64000]
function measure(md, src) {
const start = performance.now()
md.render(src)
return (performance.now() - start).toFixed(1)
}
const variants = {
comment: '<!--',
processing: '<?x',
declaration: '<!A',
cdata: '<![CDATA['
}
for (const [name, opener] of Object.entries(variants)) {
console.log(`\n${name}`)
for (const n of sizes) {
const src = 'x ' + opener.repeat(n)
console.log({
n,
bytes: Buffer.byteLength(src),
ms: measure(mdHtml, src)
})
}
}
const n = sizes.at(-1)
const controls = {
'HTML disabled': [mdDefault, 'x ' + '<!--'.repeat(n)],
'Closed comments': [mdHtml, 'x ' + '<!---->'.repeat(n)],
'HTML block': [mdHtml, '<!--'.repeat(n)],
'Plain text': [mdHtml, 'x ' + 'abcd'.repeat(n)]
}
for (const [name, [md, src]] of Object.entries(controls)) {
console.log({ control: name, ms: measure(md, src) })
}
const repoPayload = '</' + '<!--'.repeat(100000)
console.log({
payload: 'Existing pathological test',
htmlFalseMs: measure(mdDefault, repoPayload),
htmlTrueMs: measure(mdHtml, repoPayload)
})Measurements from the original report on markdown-it@15.0.2, Node.js 20:
| Construct | 8,000 repetitions | 64,000 repetitions |
|---|---|---|
| Comment | 170 ms | 8,799 ms |
| Processing instruction | 26 ms | 1,566 ms |
| Declaration | 93 ms | 5,628 ms |
| CDATA | 119 ms | 4,179 ms |
An eightfold increase in repetitions produces approximately 35–60 times the execution time, consistent with quadratic growth becoming dominant.
For the comment payload at 64,000 repetitions:
- HTML disabled: 25 ms.
- Closed comments: 29 ms.
- Payload at the start of an HTML block: 1 ms.
- Plain text: 1 ms.
The existing pathological-test payload with 100,000 comment openers took 33 ms with HTML disabled and 21,030 ms with HTML enabled. A separate comment payload with 128,000 repetitions, approximately 500 KiB, took 32,847 ms.
Exact timings depend on the runtime and hardware.
Impact
This is an availability issue affecting applications that render attacker-controlled Markdown with html: true, including applications using the commonmark preset.
On Node.js, a synchronous render() call can occupy a CPU core and block the event loop for seconds or tens of seconds, delaying other requests handled by the same process. Repeated submissions can cause denial of service. Browser applications can similarly become unresponsive when rendering on the main thread.
Sanitizing the generated HTML afterwards does not prevent the issue because the expensive processing occurs during Markdown rendering.
The default configuration, with HTML disabled, is unaffected by these payloads. Disabling HTML or limiting input size can reduce exposure while a fix is prepared.
The reported affected release is 15.0.2; the full affected version range has not been established.
warning: Package 'braces@3.0.3' is vulnerable to 'CVE-2026-93687' (also known as 'GHSA-vfj7-8cjw-p6xm').
= CVE-2026-93687: braces vulnerable to stack-exhaustion denial of service through deeply nested patterns
= braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Node.js process with an uncaught RangeError.
warning: Package 'braces@3.0.3' is vulnerable to 'CVE-2026-93687' (also known as 'GHSA-vfj7-8cjw-p6xm').
= CVE-2026-93687: braces vulnerable to stack-exhaustion denial of service through deeply nested patterns
= braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Node.js process with an uncaught RangeError.
warning: Package 'certifi@2026.2.25' is vulnerable to 'PYSEC-2026-4320' (also known as 'GHSA-6q48-6c7w-9gw2').
= PYSEC-2026-4320: certifi bundles emSign root CAs with compromised intermediate CA keys
= Certifi versions before 2026.10.18 include the emSign ECC Root CA - G3 root certificate in their bundled CA store. Eight eMudhra intermediate CA certificates that chain to this root have compromised private keys and the CA has revoked them.
An attacker with one of the compromised keys can issue valid-looking certificates for any hostname. If the attacker is also on-path, they can intercept or modify TLS traffic from clients that trust the certifi bundle. Examples include requests, urllib3 and pip, and the Python.org macOS installer.
Certifi 2026.10.18 removed all emSign roots from the bundle. Certifi 2026.10.19 restored the emSign roots that are not affected. Upgrade to 2026.10.19 or later, and rebuild container images that vendor certifi.
warning: Package 'bare-metal@0.2.5' is vulnerable to 'RUSTSEC-2026-0110'.
= RUSTSEC-2026-0110: bare-metal is deprecated
= The bare-metal crate has been deprecated and archived.
For Mutex and CriticalSection, see the critical-section crate instead.
warning: Package 'bare-metal@0.2.5' is vulnerable to 'RUSTSEC-2026-0110'.
= RUSTSEC-2026-0110: bare-metal is deprecated
= The bare-metal crate has been deprecated and archived.
For Mutex and CriticalSection, see the critical-section crate instead.
warning: 13 warnings emitted
(Truncated to last 10000 characters out of 28464)
</details>
See detailed reports in [MegaLinter artifacts](https://github.com/philips-software/amp-devcontainer/actions/runs/39557516968)
You could have the same capabilities but better runtime performances if you use a MegaLinter flavor:
- [oxsecurity/megalinter/flavors/salesforce@v10.1.0](https://megalinter.io/10.1.0/flavors/salesforce/) (58 linters)
Your project could benefit from a custom flavor, which would allow you to run only the linters you need, and thus improve runtime performances. (Skip this info by defining `FLAVOR_SUGGESTIONS: false`)
- Documentation: [Custom Flavors](https://megalinter.io/10.1.0/custom-flavors/)
- Command: `npx mega-linter-runner@10.1.0 --custom-flavor-setup --custom-flavor-linters ACTION_ACTIONLINT,DOCKERFILE_HADOLINT,JSON_V8R,JSON_PRETTIER,JSON_NPM_PACKAGE_JSON_LINT,MARKDOWN_MARKDOWNLINT,MARKDOWN_MARKDOWN_TABLE_FORMATTER,REPOSITORY_CHECKOV,REPOSITORY_GIT_DIFF,REPOSITORY_BETTERLEAKS,REPOSITORY_GRYPE,REPOSITORY_OSV_SCANNER,REPOSITORY_SECRETLINT,REPOSITORY_SYFT,REPOSITORY_TRIVY,REPOSITORY_TRIVY_SBOM,REPOSITORY_TRUFFLEHOG,SPELL_LYCHEE,YAML_PRETTIER,YAML_YAMLLINT,YAML_V8R`
[](https://www.ox.security/?ref=megalinter)
Show us your support by [**starring ⭐ the repository**](https://github.com/oxsecurity/megalinter)
<!-- megalinter: github-comment-reporter workflow='Linting & Formatting' jobid='linter' -->
📦 Container Size AnalysisNote Comparing 📈 Size Comparison Table
|
📦 Container Size AnalysisNote Comparing 📈 Size Comparison Table
|
📦 Container Size AnalysisNote Comparing 📈 Size Comparison Table
|
📦 Container Size AnalysisNote Comparing 📈 Size Comparison Table
|
📦 Container Size AnalysisNote Comparing 📈 Size Comparison Table
|
Test Results 25 files ±0 25 suites ±0 9m 30s ⏱️ +33s For more details on these failures, see this check. Results for commit 6f17555. ± Comparison against base commit 4cd32f7. ♻️ This comment has been updated with latest results. |
|
Copilot can you diagnose and fix the failing test |
I traced CI run 39371756150: no integration test failed. Both base-image build jobs stop at |
|
Copilot can you update this PR to ccache 4.14.2; make sure to update the SHAs and PR details as well. |
Co-authored-by: rjaegers <45816308+rjaegers@users.noreply.github.com>
Head branch was pushed to by a user without write access
|
Updated the Dockerfile to ccache 4.14.2 and verified all four official amd64/arm64 archive and minisig SHA256 digests in commit |
Ron (rjaegers)
changed the title
Dependency Review SummaryThe full dependency review summary was too large to display here (1123KB, limit is 1024KB). Please download the artifact named "dependency-review-summary" to view the complete report. |
🚀 Hey, I have created a Pull Request
Description of changes
This pull request updates the version of
ccacheused in the C++ devcontainer and ensures the corresponding download checksums are correct for both amd64 and arm64 architectures.Dependency updates:
CCACHE_VERSIONfrom4.13.1to4.14.2in.devcontainer/cpp/Dockerfile, ensuring the container uses the latest stable release.Build integrity:
ccachetarballs and their minisign signature files for both amd64 and arm64 architectures to match the new4.14.2release in.devcontainer/cpp/Dockerfile. [1] [2]✔️ Checklist