Skip to content

fix(security): Resolve CVE-GHSA-cgrx-mc8f-2prm by upgrading selinux to v1.13.0#2476

Merged
jjbustamante merged 12 commits intomainfrom
chore/fix-cve-GHSA-cgrx-mc8f-2prm
Nov 22, 2025
Merged

fix(security): Resolve CVE-GHSA-cgrx-mc8f-2prm by upgrading selinux to v1.13.0#2476
jjbustamante merged 12 commits intomainfrom
chore/fix-cve-GHSA-cgrx-mc8f-2prm

Conversation

@jjbustamante
Copy link
Copy Markdown
Member

@jjbustamante jjbustamante commented Nov 22, 2025

Summary

Changes

Code Changes

  • Updated kaniko imports in pkg/cache/volume_cache.go and pkg/client/build.go to use chainguard-dev/kaniko

Dependency Updates

Dependency From To Reason
chainguard-dev/kaniko N/A (was GoogleContainerTools) v1.25.4 Migrate to maintained fork
buildpacks/lifecycle v0.20.11 v0.20.19 Uses Chainguard kaniko
opencontainers/selinux v1.12.0 v1.13.0 Fix CVE-GHSA-cgrx-mc8f-2prm
golang.org/x/crypto v0.43.0 v0.45.0 Fix GHSA-j5w8-q4qc-rx2x, GHSA-f6x5-jh6r-wrfv
moby/buildkit v0.22.0 v0.26.1 Transitive update

Security Impact

  • ✅ Resolves High severity CVE-GHSA-cgrx-mc8f-2prm
  • ✅ Resolves 2 Medium severity CVEs in golang.org/x/crypto
  • ✅ Migrates to actively maintained kaniko fork for future security updates

Test Plan

  • Verify build succeeds
  • Run security scan to confirm CVEs are resolved
  • Run existing test suite
  • Verify kaniko functionality works correctly with the Chainguard fork

🤖 Generated with Claude Code

@jjbustamante jjbustamante requested review from a team as code owners November 22, 2025 20:38
@github-actions github-actions Bot added type/enhancement Issue that requests a new feature or improvement. type/chore Issue that requests non-user facing changes. labels Nov 22, 2025
@github-actions github-actions Bot added this to the 0.39.0 milestone Nov 22, 2025
dependabot Bot and others added 9 commits November 22, 2025 15:42
@dependabot @jjbustamante
build(deps): bump @octokit/plugin-paginate-rest, @actions/github and …
f04e4a5 
…@octokit/rest (#2338)

Bumps [@octokit/plugin-paginate-rest](https://github.com/octokit/plugin-paginate-rest.js) to 9.2.2 and updates ancestor dependencies [@octokit/plugin-paginate-rest](https://github.com/octokit/plugin-paginate-rest.js), [@actions/github](https://github.com/actions/toolkit/tree/HEAD/packages/github) and [@octokit/rest](https://github.com/octokit/rest.js). These dependencies need to be updated together.

Updates `@octokit/plugin-paginate-rest` from 2.2.3 to 9.2.2
- [Release notes](https://github.com/octokit/plugin-paginate-rest.js/releases)
- [Commits](octokit/plugin-paginate-rest.js@v2.2.3...v9.2.2)

Updates `@actions/github` from 4.0.0 to 6.0.0
- [Changelog](https://github.com/actions/toolkit/blob/main/packages/github/RELEASES.md)
- [Commits](https://github.com/actions/toolkit/commits/HEAD/packages/github)

Updates `@octokit/rest` from 18.0.0 to 21.1.1
- [Release notes](https://github.com/octokit/rest.js/releases)
- [Commits](octokit/rest.js@v18.0.0...v21.1.1)

---
updated-dependencies:
- dependency-name: "@octokit/plugin-paginate-rest"
  dependency-type: indirect
- dependency-name: "@actions/github"
  dependency-type: direct:production
- dependency-name: "@octokit/rest"
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: Juan Bustamante <bustamantejj@gmail.com>
@dependabot @jjbustamante
build(deps): bump @octokit/request, @actions/github and @octokit/rest (…
5ed2d2e 
…#2370)

Bumps [@octokit/request](https://github.com/octokit/request.js) to 8.4.1 and updates ancestor dependencies [@octokit/request](https://github.com/octokit/request.js), [@actions/github](https://github.com/actions/toolkit/tree/HEAD/packages/github) and [@octokit/rest](https://github.com/octokit/rest.js). These dependencies need to be updated together.

Updates `@octokit/request` from 5.6.3 to 8.4.1
- [Release notes](https://github.com/octokit/request.js/releases)
- [Commits](octokit/request.js@v5.6.3...v8.4.1)

Updates `@actions/github` from 4.0.0 to 6.0.0
- [Changelog](https://github.com/actions/toolkit/blob/main/packages/github/RELEASES.md)
- [Commits](https://github.com/actions/toolkit/commits/HEAD/packages/github)

Updates `@octokit/rest` from 18.0.0 to 21.1.1
- [Release notes](https://github.com/octokit/rest.js/releases)
- [Commits](octokit/rest.js@v18.0.0...v21.1.1)

---
updated-dependencies:
- dependency-name: "@octokit/request"
  dependency-version: 8.4.1
  dependency-type: indirect
- dependency-name: "@actions/github"
  dependency-version: 6.0.0
  dependency-type: direct:production
- dependency-name: "@octokit/rest"
  dependency-version: 21.1.1
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: Juan Bustamante <bustamantejj@gmail.com>
@dependabot @jjbustamante
build(deps): bump the go-dependencies group with 8 updates (#2453)
4ec0d90 
Bumps the go-dependencies group with 8 updates:

| Package | From | To |
| --- | --- | --- |
| [github.com/docker/cli](https://github.com/docker/cli) | `28.5.0+incompatible` | `28.5.1+incompatible` |
| [github.com/docker/docker](https://github.com/docker/docker) | `28.5.0+incompatible` | `28.5.1+incompatible` |
| [golang.org/x/crypto](https://github.com/golang/crypto) | `0.42.0` | `0.43.0` |
| [golang.org/x/mod](https://github.com/golang/mod) | `0.28.0` | `0.29.0` |
| [golang.org/x/oauth2](https://github.com/golang/oauth2) | `0.31.0` | `0.32.0` |
| [golang.org/x/sys](https://github.com/golang/sys) | `0.36.0` | `0.37.0` |
| [golang.org/x/term](https://github.com/golang/term) | `0.35.0` | `0.36.0` |
| [golang.org/x/text](https://github.com/golang/text) | `0.29.0` | `0.30.0` |

Updates `github.com/docker/cli` from 28.5.0+incompatible to 28.5.1+incompatible
- [Commits](docker/cli@v28.5.0...v28.5.1)

Updates `github.com/docker/docker` from 28.5.0+incompatible to 28.5.1+incompatible
- [Release notes](https://github.com/docker/docker/releases)
- [Commits](moby/moby@v28.5.0...v28.5.1)

Updates `golang.org/x/crypto` from 0.42.0 to 0.43.0
- [Commits](golang/crypto@v0.42.0...v0.43.0)

Updates `golang.org/x/mod` from 0.28.0 to 0.29.0
- [Commits](golang/mod@v0.28.0...v0.29.0)

Updates `golang.org/x/oauth2` from 0.31.0 to 0.32.0
- [Commits](golang/oauth2@v0.31.0...v0.32.0)

Updates `golang.org/x/sys` from 0.36.0 to 0.37.0
- [Commits](golang/sys@v0.36.0...v0.37.0)

Updates `golang.org/x/term` from 0.35.0 to 0.36.0
- [Commits](golang/term@v0.35.0...v0.36.0)

Updates `golang.org/x/text` from 0.29.0 to 0.30.0
- [Release notes](https://github.com/golang/text/releases)
- [Commits](golang/text@v0.29.0...v0.30.0)

---
updated-dependencies:
- dependency-name: github.com/docker/cli
  dependency-version: 28.5.1+incompatible
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: github.com/docker/docker
  dependency-version: 28.5.1+incompatible
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: golang.org/x/crypto
  dependency-version: 0.43.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: golang.org/x/mod
  dependency-version: 0.29.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: golang.org/x/oauth2
  dependency-version: 0.32.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: golang.org/x/sys
  dependency-version: 0.37.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: golang.org/x/term
  dependency-version: 0.36.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: golang.org/x/text
  dependency-version: 0.30.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: Juan Bustamante <bustamantejj@gmail.com>
@jjbustamante @claude
fix(security): resolve CVE-GHSA-cgrx-mc8f-2prm by upgrading selinux t…
af5693d 
…o v1.13.0

Migrated from unmaintained GoogleContainerTools/kaniko to the actively maintained Chainguard fork (v1.25.4), updated lifecycle to v0.20.19, and upgraded opencontainers/selinux from v1.12.0 to v1.13.0 to fix GHSA-cgrx-mc8f-2prm. This also upgraded golang.org/x/crypto from v0.43.0 to v0.45.0, resolving additional CVEs.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Juan Bustamante <bustamantejj@gmail.com>
@jjbustamante @claude
Use Docker API version negotiation instead of hardcoded version
db6a58b 
Fixes #2464

This change replaces all hardcoded Docker API version 1.38 references
with WithAPIVersionNegotiation(), allowing pack to automatically adapt
to the Docker daemon's supported API version.

Changes:
- Updated main client initialization to use API version negotiation
- Updated SSH Docker client to use API version negotiation
- Updated all test files to use API version negotiation
- Upgraded fake-lifecycle test dependencies from Docker client v1.4.2 (2019) to v28.5.1
- Fixed fake-lifecycle imports and API calls for compatibility with modern Docker client

Benefits:
- Works with modern Docker daemons requiring API 1.44+ (Docker 27+)
- Backward compatible with older Docker versions
- Future-proof - no need to update hardcoded versions
- Solves Windows runner issue without requiring Docker 27 upgrade

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Juan Bustamante <bustamantejj@gmail.com>
@jjbustamante @claude
Update Example_build test to use newer builder with modern lifecycle
241ed4c 
The cnbs/sample-builder:noble builder includes a recent lifecycle version
that supports Docker API 1.44+, fixing the test failure on systems with
modern Docker daemons (Docker 27+).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Juan Bustamante <bustamantejj@gmail.com>
@jjbustamante @claude
Downgrade fake-lifecycle dependencies for Go 1.23 compatibility
f4d60b5 
Updated fake-lifecycle test module to support Go 1.23.4 (Windows runner):
- Downgraded lifecycle from v0.20.11 to v0.19.3
- Downgraded go-containerregistry from v0.20.6 to v0.19.2
- Set Go requirement to 1.23 (compatible with Go 1.23.4)
- Updated Dockerfile to use golang:1.23 base image

The older versions still support Docker API 1.44+ and work correctly
with modern Docker daemons requiring minimum API version 1.44.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Juan Bustamante <bustamantejj@gmail.com>
@jjbustamante
updating fake-lifecycle go version
5231832 
Signed-off-by: Juan Bustamante <bustamantejj@gmail.com>
@jjbustamante @claude
Use Docker API version negotiation instead of hardcoded version (#2474)
1e13190 
* Use Docker API version negotiation instead of hardcoded version

Fixes #2464

This change replaces all hardcoded Docker API version 1.38 references
with WithAPIVersionNegotiation(), allowing pack to automatically adapt
to the Docker daemon's supported API version.

Changes:
- Updated main client initialization to use API version negotiation
- Updated SSH Docker client to use API version negotiation
- Updated all test files to use API version negotiation
- Upgraded fake-lifecycle test dependencies from Docker client v1.4.2 (2019) to v28.5.1
- Fixed fake-lifecycle imports and API calls for compatibility with modern Docker client

Benefits:
- Works with modern Docker daemons requiring API 1.44+ (Docker 27+)
- Backward compatible with older Docker versions
- Future-proof - no need to update hardcoded versions
- Solves Windows runner issue without requiring Docker 27 upgrade

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Juan Bustamante <bustamantejj@gmail.com>

* Update Example_build test to use newer builder with modern lifecycle

The cnbs/sample-builder:noble builder includes a recent lifecycle version
that supports Docker API 1.44+, fixing the test failure on systems with
modern Docker daemons (Docker 27+).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Juan Bustamante <bustamantejj@gmail.com>

* Downgrade fake-lifecycle dependencies for Go 1.23 compatibility

Updated fake-lifecycle test module to support Go 1.23.4 (Windows runner):
- Downgraded lifecycle from v0.20.11 to v0.19.3
- Downgraded go-containerregistry from v0.20.6 to v0.19.2
- Set Go requirement to 1.23 (compatible with Go 1.23.4)
- Updated Dockerfile to use golang:1.23 base image

The older versions still support Docker API 1.44+ and work correctly
with modern Docker daemons requiring minimum API version 1.44.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Juan Bustamante <bustamantejj@gmail.com>

---------

Signed-off-by: Juan Bustamante <bustamantejj@gmail.com>
Co-authored-by: Claude <noreply@anthropic.com>
@jjbustamante jjbustamante force-pushed the chore/fix-cve-GHSA-cgrx-mc8f-2prm branch from b1a4200 to 1e13190 Compare November 22, 2025 20:43
@jjbustamante
Merge branch 'main' into chore/fix-cve-GHSA-cgrx-mc8f-2prm
30195b6 
Signed-off-by: Juan Bustamante <bustamantejj@gmail.com>
@jjbustamante
fix code format
e077af0 
Signed-off-by: Juan Bustamante <bustamantejj@gmail.com>
@jjbustamante
Merge branch 'main' into chore/fix-cve-GHSA-cgrx-mc8f-2prm
6bb113d 
Signed-off-by: Juan Bustamante <bustamantejj@gmail.com>
@jjbustamante jjbustamante added cve dependencies Pull requests that update a dependency file and removed type/enhancement Issue that requests a new feature or improvement. labels Nov 22, 2025
@jjbustamante jjbustamante merged commit 019eb74 into main Nov 22, 2025
15 checks passed
@jjbustamante jjbustamante deleted the chore/fix-cve-GHSA-cgrx-mc8f-2prm branch November 22, 2025 22:01
@jjbustamante jjbustamante mentioned this pull request Nov 23, 2025
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

cve dependencies Pull requests that update a dependency file type/chore Issue that requests non-user facing changes.

Projects

None yet

Milestone

0.39.0

Development

Successfully merging this pull request may close these issues.

fix(security): Resolve CVE-GHSA-cgrx-mc8f-2prm (selinux v1.12.0)

1 participant

@jjbustamante