Sync base-images v1.3.10, Go 1.26.5, lib-helm 1.72.10#105
Merged
duckhawk merged 3 commits intoJul 20, 2026
Conversation
- BASE_IMAGES_VERSION -> v1.3.10 - charts/deckhouse_lib_helm-1.72.10.tgz
fastrapier
previously approved these changes
Jul 20, 2026
Trivy flagged two fixable golang.org/x CVEs across the module's Go binaries (go-hooks, webhooks) and the vendored external-snapshotter driver: - golang.org/x/net CVE-2026-46600 — parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage (fixed in v0.56.0). - golang.org/x/text CVE-2026-56852 — infinite loop on invalid input (fixed in v0.39.0). Bump both (with the transitive x/crypto/x/sys/x/sync/x/term bumps they pull) in hooks/go and images/webhooks go.mod, and retarget images/snapshot-controller/patches/003-fix-cve-golang-x.patch to ship the same versions in the external-snapshotter driver tree. All our-code binaries build clean; the full patch set 001-003 applies to a fresh v8.5.0 checkout and 'make build' succeeds in module mode. Signed-off-by: v.oleynikov <vasily.oleynikov@flant.com>
golang.org/x/crypto GO-2026-5932 (the openpgp subpackage is unmaintained and unsafe) has no fixed release and is reported against both the go-hooks binary embedded in the bundle image and the external-snapshotter driver binary. The openpgp package is not used in either: in go-hooks x/crypto is pulled in only for its ocsp package (020-webhook-certs -> module-sdk tls-certificate -> cloudflare/cfssl/helpers), and in the snapshot-controller driver only for cryptobyte (k8s.io/apiserver/pkg/server); `go mod why golang.org/x/crypto/openpgp` reports the main module does not need it in either binary, so it is not compiled in. Add OpenVEX statements (status not_affected, justification vulnerable_code_not_in_execute_path) for the bundle (repo-root known_vulnerabilities.vex) and the snapshot-controller image (images/snapshot-controller/known_vulnerabilities.vex), and wire the existing "vex mitigation" template for both so cosign attaches them as attestations trivy honours. Exclude *-vex-artifact images from images-digests.yaml so the attestation carriers are not themselves published or re-scanned. Signed-off-by: v.oleynikov <vasily.oleynikov@flant.com>
fastrapier
approved these changes
Jul 20, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Automated tooling sync for snapshot-controller (scheduled
sync_storage_modules_tooling.py).v1.3.2→v1.3.10in.github/workflows/*.yml.godirective already 1.26.5 in scannedapi/,images/andhooks/modules.deckhouse_lib_helm-1.72.10.tgz(previous:1.72.9).Why do we need it, and what problem does it solve?
Keeps the module aligned with the latest deckhouse/container-base/base-images release and deckhouse/lib-helm
so CI and image builds use current base image digests, Go toolchain version, and Helm library charts.
What is the expected result?
BASE_IMAGES_VERSIONto the new (or current) tag and download matchingbase_images.yml.api/,images/andhooks/declares the same Go version as the defaultgolangtoolchain inbase_images.yml.charts/contains the currentdeckhouse_lib_helm-*.tgzwhen an update was required.Checklist