Skip to content

fix: migrate to image.yaml v2 and update ignored vulnerabilities for hydra #1182

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
zhijie-yang merged 1 commit into from
Aug 24, 2026
Merged

fix: migrate to image.yaml v2 and update ignored vulnerabilities for hydra #1182

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 0 additions & 12 deletions oci/hydra/.trivyignore
View file
Open in desktop

This file was deleted.

18 changes: 16 additions & 2 deletions oci/hydra/image.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,5 @@
version: 1
version: 2

upload:
- source: "canonical/hydra-rock"
commit: 3c27fb428fad0a339c39355b2f8cd5a477d32014
Expand All @@ -9,4 +10,17 @@ upload:
- stable
- candidate
- edge
Comment thread
shipperizer marked this conversation as resolved.
end-of-life: "2025-05-01T00:00:00Z"
end-of-life: "2025-05-01T00:00:00Z"
Comment thread
zhijie-yang marked this conversation as resolved.
ignored-vulnerabilities:
- CVE-2026-32286 # Denial of Service via malicious PostgreSQL server (jackc/pgproto3/v2). No upstream fix. https://github.com/advisories/GHSA-jqcq-xjh3-6g23
- CVE-2026-33818 # encoding/asn1: DoS via excessive recursion in Unmarshal (Go stdlib). Fixed in Go 1.26.6+. https://avd.aquasec.com/nvd/cve-2026-33818
- CVE-2026-33997 # moby/docker: Privilege validation bypass during plugin installation. Breaking API in v29+. https://avd.aquasec.com/nvd/cve-2026-33997
- CVE-2026-34040 # moby/docker: Authorization bypass vulnerability. Breaking API in v29+. https://avd.aquasec.com/nvd/cve-2026-34040
- CVE-2026-39821 # golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (Go stdlib). Fixed in Go 1.26.6+. https://avd.aquasec.com/nvd/cve-2026-39821
- CVE-2026-46600 # golang.org/x/net/dns/dnsmessage: DoS via invalid DNS record parsing (Go stdlib). Fixed in Go 1.26.6+. https://avd.aquasec.com/nvd/cve-2026-46600
- CVE-2026-56853 # net/http: Unencrypted HTTP/2 connections vulnerable to DoS (Go stdlib). Fixed in Go 1.26.6+. https://avd.aquasec.com/nvd/cve-2026-56853
- CVE-2026-56858 # html/template: Cross-Site Scripting via pathological input (Go stdlib). Fixed in Go 1.26.6+. https://avd.aquasec.com/nvd/cve-2026-56858
- CVE-2026-56859 # encoding/xml: DoS via XML decoding recursion depth issue (Go stdlib). Fixed in Go 1.26.6+. https://avd.aquasec.com/nvd/cve-2026-56859
- CVE-2026-56860 # net/url: DoS from quadratic complexity in path resolution (Go stdlib). Fixed in Go 1.26.6+. https://avd.aquasec.com/nvd/cve-2026-56860
- CVE-2026-56862 # crypto/tls: DoS via indefinite KeyUpdate messages (Go stdlib). Fixed in Go 1.26.6+. https://avd.aquasec.com/nvd/cve-2026-56862
- GO-2026-5932 # golang.org/x/crypto/openpgp: Package is unmaintained/deprecated. https://pkg.go.dev/vuln/GO-2026-5932
Loading