Summary
A JFrog Xray container scan of a workspace image that embeds agentapi-linux-amd64 from v0.12.2 flagged two security violations tied to the Go runtime version used to compile the binary.
Affected binary
- Release:
v0.12.2 (latest stable as of 2026-07-17) - Asset:
agentapi-linux-amd64 - Go version inside binary:
go1.26.3 (confirmed via strings agentapi-linux-amd64 | grep "^go1\.")
CVEs
Note: Go 1.26.4 fixes CVE-2026-42504 but is itself affected by CVE-2026-39822. The minimum patched Go version that resolves both CVEs is Go 1.26.5.
Request
Please rebuild and publish a new release of agentapi compiled with Go ≥ 1.26.5. This would clear both CVEs from downstream container scans.
No code changes should be required — only a toolchain bump in the build pipeline.
How we detected it
These findings appeared in a JFrog Xray container scan. The scanner identifies the Go toolchain version embedded in the binary and cross-references it against known CVEs.
Summary
A JFrog Xray container scan of a workspace image that embeds
agentapi-linux-amd64fromv0.12.2flagged two security violations tied to the Go runtime version used to compile the binary.Affected binary
v0.12.2(latest stable as of 2026-07-17)agentapi-linux-amd64go1.26.3(confirmed viastrings agentapi-linux-amd64 | grep "^go1\.")CVEs
Note: Go 1.26.4 fixes CVE-2026-42504 but is itself affected by CVE-2026-39822. The minimum patched Go version that resolves both CVEs is Go 1.26.5.
Request
Please rebuild and publish a new release of
agentapicompiled with Go ≥ 1.26.5. This would clear both CVEs from downstream container scans.No code changes should be required — only a toolchain bump in the build pipeline.
How we detected it
These findings appeared in a JFrog Xray container scan. The scanner identifies the Go toolchain version embedded in the binary and cross-references it against known CVEs.