nathanlaceyraft

New patch release with CVE fixes

3

Would it be possible to get a patch release with the CVE fixes? https://github.com/terrastruct/d2/pull/2383 and https://github.com/terrastruct/d2/pull/2381 thanks

remove gosu CVE's by custom building gosu with updated golang

1

gosu is build with a unsupported version of go (1.18) The two support go versions that have the most CVE's resolved are 1.23.6 and 1.24.0 I felt using 1.23.6 was...

Custom build gosu with current go to remove CVEs

1

### Summary gosu security policy https://github.com/tianon/gosu/blob/master/SECURITY.md says they don't update golang for CVE's So gosu is build with a unsupported version of go (1.20) The two support go versions that...

trivy image --scanners vuln edenhill/kcat:1.7.1 shows the following cve apk-tools │ CVE-2021-36159 │ CRITICAL │ fixed │ 2.10.6-r0 │ 2.10.7-r0 │ libfetch: an out of boundary read while libfetch uses...

Following PR will resolve https://github.com/datarhei/core/issues/30 datarhei/restreamer has CVE's because of core CVE's in core found by doing govulncheck ./... === Symbol Results === Vulnerability #1: GO-2025-3595 Incorrect Neutralization of Input...

govulncheck ./... === Symbol Results === Vulnerability https://github.com/datarhei/core/pull/1: GO-2025-3595 Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net More info: https://pkg.go.dev/vuln/GO-2025-3595 Module: golang.org/x/net Found in: [golang.org/x/[email protected]](mailto:golang.org/x/[email protected]) Fixed...

manually build gosu with current golang image to resolve CVE (pull/1323)

1

https://github.com/docker-library/postgres/pull/1323 trivy image --scanners vuln shows that we'll get rid of the following CVE's usr/local/bin/gosu (gobinary) Total: 58 (UNKNOWN: 0, LOW: 1, MEDIUM: 23, HIGH: 31, CRITICAL: 3) gosu security...