fix(security): pass Trivy scan for OpenAPI CLIs and bump tool versions

Bump Go-based CLIs to patched releases, consolidate OpenAPI npm installs
with CVE overrides, and extend trivyignore for remaining base-image findings.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: miragecentury

.trivyignore

@@ -82,3 +82,22 @@ CVE-2026-42504 exp:2026-08-19
 CVE-2026-44973 exp:2026-08-19
 CVE-2026-45022 exp:2026-08-19
 CVE-2026-46680 exp:2026-08-19
+#
+# Go stdlib / x/crypto / x/net / containerd — base image and pinned CLIs without fixed releases yet.
+CVE-2026-25681 exp:2026-08-19
+CVE-2026-27136 exp:2026-08-19
+CVE-2026-27145 exp:2026-08-19
+CVE-2026-39821 exp:2026-08-19
+CVE-2026-39822 exp:2026-08-19
+CVE-2026-39828 exp:2026-08-19
+CVE-2026-39829 exp:2026-08-19
+CVE-2026-39830 exp:2026-08-19
+CVE-2026-39831 exp:2026-08-19
+CVE-2026-39832 exp:2026-08-19
+CVE-2026-39835 exp:2026-08-19
+CVE-2026-42508 exp:2026-08-19
+CVE-2026-46595 exp:2026-08-19
+CVE-2026-46597 exp:2026-08-19
+CVE-2026-53488 exp:2026-08-19
+CVE-2026-53489 exp:2026-08-19
+CVE-2026-53492 exp:2026-08-19

CHANGELOG.md

@@ -62,9 +62,15 @@
 
 - **release:** configure semantic-release to treat `chore` commits as minor releases and include them in generated release notes
 - **image:** pre-cache commonly used GitHub Actions from `manifest.yaml` into the runner `_work/_actions` directory during image build
+- **image:** bump syft, grype, yq, argo, kargo, pack, and kubectl to latest releases
+- **image:** install OpenAPI npm CLIs in a single prefix with transitive dependency CVE overrides
 
 ### Fixed
 
+### Security
+
+- **image:** extend `.trivyignore` for unfixed Go CVEs in base containerd and pinned CLIs
+
 ## [1.2.3](https://github.com/DeerHide/python-github-runner/compare/v1.2.2...v1.2.3) (2026-04-25)
 
 ### Added

Containerfile

@@ -49,7 +49,7 @@ RUN curl -fsSL https://aquasecurity.github.io/trivy-repo/deb/public.key \
     && rm -rf /var/lib/apt/lists/*
 
 # Install syft (SBOM generator)
-ARG SYFT_VERSION=1.43.0
+ARG SYFT_VERSION=1.46.0
 RUN curl -sSL -o /tmp/syft.tgz \
       "https://github.com/anchore/syft/releases/download/v${SYFT_VERSION}/syft_${SYFT_VERSION}_linux_amd64.tar.gz" \
     && tar -xzf /tmp/syft.tgz -C /tmp syft \
@@ -58,7 +58,7 @@ RUN curl -sSL -o /tmp/syft.tgz \
     && rm -f /tmp/syft.tgz
 
 # Install grype (vulnerability scanner)
-ARG GRYPE_VERSION=0.111.1
+ARG GRYPE_VERSION=0.115.0
 RUN curl -sSL -o /tmp/grype.tgz \
       "https://github.com/anchore/grype/releases/download/v${GRYPE_VERSION}/grype_${GRYPE_VERSION}_linux_amd64.tar.gz" \
     && tar -xzf /tmp/grype.tgz -C /tmp grype \
@@ -84,33 +84,33 @@ RUN curl -sSL -o /usr/local/bin/hadolint \
     && chmod +x /usr/local/bin/hadolint
 
 # Install yq (YAML processor)
-ARG YQ_VERSION=4.53.2
+ARG YQ_VERSION=4.53.3
 RUN curl -sSL -o /usr/local/bin/yq \
       "https://github.com/mikefarah/yq/releases/download/v${YQ_VERSION}/yq_linux_amd64" \
     && chmod +x /usr/local/bin/yq
 
 # Install Argo Workflows CLI
-ARG ARGO_VERSION=4.0.4
+ARG ARGO_VERSION=4.0.7
 RUN curl -sSL -o /tmp/argo-linux-amd64.gz \
       "https://github.com/argoproj/argo-workflows/releases/download/v${ARGO_VERSION}/argo-linux-amd64.gz" \
     && gunzip /tmp/argo-linux-amd64.gz \
     && mv /tmp/argo-linux-amd64 /usr/local/bin/argo \
     && chmod +x /usr/local/bin/argo
 
 # Install Kargo CLI
-ARG KARGO_VERSION=1.9.6
+ARG KARGO_VERSION=1.10.8
 RUN curl -sSL -o /usr/local/bin/kargo \
       "https://github.com/akuity/kargo/releases/download/v${KARGO_VERSION}/kargo-linux-amd64" \
     && chmod +x /usr/local/bin/kargo
 
 # Install kubectl (in-cluster kpack Build CRs from green ARC runners)
-ARG KUBECTL_VERSION=1.33.2
+ARG KUBECTL_VERSION=1.36.2
 RUN curl -sSL -o /usr/local/bin/kubectl \
       "https://dl.k8s.io/release/v${KUBECTL_VERSION}/bin/linux/amd64/kubectl" \
     && chmod +x /usr/local/bin/kubectl
 
 # Install pack (Cloud Native Buildpacks CLI)
-ARG PACK_VERSION=0.40.2
+ARG PACK_VERSION=0.40.8
 RUN curl -sSL -o /tmp/pack.tgz \
       "https://github.com/buildpacks/pack/releases/download/v${PACK_VERSION}/pack-v${PACK_VERSION}-linux.tgz" \
     && tar -xzf /tmp/pack.tgz -C /usr/local/bin/ \
@@ -134,26 +134,24 @@ RUN curl -sSL -o /tmp/bun.zip \
     && ln -sf /usr/local/bin/bun /usr/local/bin/bunx \
     && rm -rf /tmp/bun.zip /tmp/bun-linux-x64-baseline
 
-# Install Redocly CLI (OpenAPI linter and bundler)
-# OpenAPI tool versions kept aligned with customer_backend/scripts/openapi-tools.env
+# OpenAPI CLIs: oasdiff is a standalone Go binary; npm-only tools share one prefix
+# install with CVE overrides (openapi-tools/package.json). Versions aligned with
+# customer_backend/scripts/openapi-tools.env and manifest.yaml build args.
 ARG REDOCLY_CLI_VERSION=2.39.0
-# hadolint ignore=DL3013
-RUN npm install -g "@redocly/cli@${REDOCLY_CLI_VERSION}"
-
-# Install Spectral CLI (OpenAPI/AsyncAPI linter)
 ARG SPECTRAL_CLI_VERSION=6.16.1
-# hadolint ignore=DL3013
-RUN npm install -g "@stoplight/spectral-cli@${SPECTRAL_CLI_VERSION}"
-
-# Install Portman (OpenAPI to Postman contract tests)
 ARG PORTMAN_VERSION=1.35.0
-# hadolint ignore=DL3013
-RUN npm install -g "@apideck/portman@${PORTMAN_VERSION}"
-
-# Install Newman (Postman collection runner)
 ARG NEWMAN_VERSION=6.2.2
+COPY openapi-tools/package.json /tmp/openapi-tools/
 # hadolint ignore=DL3013
-RUN npm install -g "newman@${NEWMAN_VERSION}"
+RUN npm install --prefix /tmp/openapi-tools --omit=dev --no-package-lock \
+      "@redocly/cli@${REDOCLY_CLI_VERSION}" \
+      "@stoplight/spectral-cli@${SPECTRAL_CLI_VERSION}" \
+      "@apideck/portman@${PORTMAN_VERSION}" \
+      "newman@${NEWMAN_VERSION}" \
+    && for bin in redocly openapi spectral portman newman; do \
+         ln -sf "/tmp/openapi-tools/node_modules/.bin/${bin}" "/usr/local/bin/${bin}"; \
+       done \
+    && rm -rf /root/.npm
 
 # Install oasdiff (OpenAPI diff and breaking-change detection)
 ARG OASDIFF_VERSION=1.23.0

manifest.yaml

@@ -6,14 +6,15 @@ build:
   format: oci
   args:
     - RUNNER_VERSION=2.335.1
-    - ARGO_VERSION=4.0.5
-    - KARGO_VERSION=1.10.2
-    - PACK_VERSION=0.40.3
+    - ARGO_VERSION=4.0.7
+    - KARGO_VERSION=1.10.8
+    - PACK_VERSION=0.40.8
+    - KUBECTL_VERSION=1.36.2
     - DIVE_VERSION=0.13.1
-    - SYFT_VERSION=1.43.0
-    - GRYPE_VERSION=0.111.1
+    - SYFT_VERSION=1.46.0
+    - GRYPE_VERSION=0.115.0
     - HADOLINT_VERSION=2.14.0
-    - YQ_VERSION=4.53.2
+    - YQ_VERSION=4.53.3
     - NODE_VERSION=24.16.0
     - BUN_VERSION=1.3.14
     - REDOCLY_CLI_VERSION=2.39.0

openapi-tools/package.json

@@ -0,0 +1,14 @@
+{
+  "name": "openapi-tools",
+  "private": true,
+  "description": "CVE overrides for OpenAPI npm CLIs installed via Containerfile. Tool versions come from manifest.yaml build args.",
+  "overrides": {
+    "flatted": "3.4.2",
+    "handlebars": "4.7.9",
+    "lodash": "4.18.0",
+    "node-forge": "1.4.0",
+    "sigstore": "4.1.1",
+    "underscore": "1.13.8",
+    "undici": "6.27.0"
+  }
+}