Uh oh!
There was an error while loading. Please reload this page.
fix(ci): bump ci-image tooling versions to clear vendored CVEs - #929
Merged
Conversation
Bumps the CI image tool pins to clear High-severity container findings flagged by nSpect against ghcr.io/nvidia/openshell/ci. These tools vendor the Go modules reported in the nSpect tracker. Changes: - DOCKER_VERSION 29.3.1 -> 29.4.1 - BUILDX_VERSION v0.32.1 -> v0.33.0 (bundles buildkit v0.29.0, supersedes 0.28.1 fix) - GH_VERSION 2.74.1 -> 2.91.0 - MISE_VERSION v2026.3.13 -> v2026.4.18 Covers (via vendored deps in the above binaries): - GHSA-p77j-4mvh-x3m3 grpc-go authorization bypass - GHSA-4c29-8rgm-jvjj BuildKit malicious-frontend file escape - GHSA-4vrq-3vrq-g6gg BuildKit Git subdir access to restricted files - GHSA-9h8m-3fm2-qjrq OpenTelemetry Go SDK PATH hijacking - GHSA-92mm-2pjq-r785 hashicorp/go-getter arbitrary file reads - GHSA-78h2-9frx-2jm8 go-jose JWE decryption panic - GHSA-4qg8-fj49-pxjh sigstore timestamp-authority excessive memory - GHSA-x744-4wpc-v9h2 Moby AuthZ plugin bypass Signed-off-by: John Myers <9696606+johntmyers@users.noreply.github.com>
pimlock
approved these changes
Apr 23, 2026
Uh oh!
There was an error while loading. Please reload this page.
pimlock added a commit
that referenced
this pull request
Apr 23, 2026
mise 2026.4.18 (bumped in #929) renamed the `--no-prepare` flag to `--no-deps`. Update workflow invocations to match.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Bumps Docker CLI, buildx, gh, and mise pins in
Dockerfile.cito clear High-severity container findings inghcr.io/nvidia/openshell/ci. Source: nSpect Security Tracker (NSPECT-4VVR-UWWE).Related Issue
No tracking issue — direct remediation from the nSpect tracker; security vulns are not filed as GitHub issues per
SECURITY.md.Changes
DOCKER_VERSION29.3.1 → 29.4.1BUILDX_VERSIONv0.32.1 → v0.33.0 (bundles buildkit v0.29.0, above the 0.28.1 fix target)GH_VERSION2.74.1 → 2.91.0MISE_VERSIONv2026.3.13 → v2026.4.18Findings addressed (vendored Go modules inside these binaries):
Final vendored versions will be verified post-merge via nSpect OSS scan.
Testing
Dockerfile.ci)Checklist