Repository navigation
Upgrade Debian perl packages in the pg and cassandra 4.1 images - #13
Merged
Merged
Conversation
Debian published perl 5.36.0-7+deb12u4, fixing CVE-2026-13221, -8376, -42496 (CRITICAL) and -42497, -48962, -57432, -57433 (HIGH). The pinned bookworm bases still carry deb12u3, so Trivy's fixed-only HIGH/CRITICAL gate failed every pg major and cassandra 4.1 on both architectures. pgvector has not rebuilt 0.8.6 since 2026-08-13, so there is no newer base digest to repin to. Upgrade the named packages instead, the same pattern already used for pcre2 and expat: the four perl packages in pg move together because perl depends on the exact perl-base version, and cassandra 4.1 carries perl-base only. The scan gate is unchanged.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Trivy's scan gate (HIGH/CRITICAL, fixed-only) started failing on every pg major and cassandra 4.1, on amd64 and arm64, after Debian released perl
5.36.0-7+deb12u4. The pinned bookworm bases still shipdeb12u3. It shows up on #12, which only adds secret-scanner config.Cassandra 4.1 carries only
perl-base. No unfixed finding failed the gate.Change
images/pg/Dockerfile: addperl perl-base perl-modules-5.36 libperl5.36to the existing named-package--only-upgradeline. They move together becauseperldepends on the exactperl-baseversion.images/cassandra/Dockerfile: addperl-baseto the same line.A repin isn't possible:
pgvector/pgvector:0.8.6-pg*was last pushed on 2026-08-13. The scanner config, severity gate and.trivyignore.yamlare unchanged. Patroni builds FROM the pg image, so it inherits the fix.Verification
make verify-structureandmake lintpass locally.