Repository navigation
fix: keep Trivy SARIF uploads healthy - #879
Merged
Merged
Conversation
Separate the Trivy SARIF upload from the vulnerability gate so GitHub Security still receives results even when the HIGH/CRITICAL gate fails, and refresh the agent host image toolchain to pick up the current fixable findings. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 11857092-1327-41bd-8708-b2ca85e674dd
The go-tools stage bumps golang.org/x/mod via 'go get' before building buildctl from source, but buildkit vendors its dependencies. Without running 'go mod vendor' afterward, the build fails with: go: inconsistent vendoring in /src/buildkit: golang.org/x/mod@v0.40.0: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 11857092-1327-41bd-8708-b2ca85e674dd
sabbour
enabled auto-merge (squash)
August 24, 2026 20:32
CVE-2026-56852 (golang.org/x/text DoS via invalid UTF-8) is only fixed in x/text v0.39.0, but it's embedded in the prebuilt @typescript/typescript-linux-x64 native tsc binary that ships with the typescript npm package. 7.1.0-dev.20260817.1 is the newest available prerelease and still bundles v0.38.0 — there's no newer upstream build to bump to, so suppress this specific CVE like the other prebuilt-binary entries this file already documents. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 11857092-1327-41bd-8708-b2ca85e674dd
…tsc binary The pinned tsc native binary (typescript 7.1.0-dev.20260817.1, latest available prerelease) also embeds Go stdlib v1.26.4, which carries 8 more HIGH CVEs fixed only in 1.25.13/1.26.6/1.27.0-rc.3. Same unfixable-third-party-binary situation as CVE-2026-56852 already suppressed for this binary's x/text dependency. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 11857092-1327-41bd-8708-b2ca85e674dd
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Validation