Security scan for main branch

[dex4er]

Grype runtime vulnerability scan for 4878c7c879c5, updated 2026-09-05 22:20 UTC by this run.

Severity	Risk	Package	Type	Installed	Fixed In	Advisory	Location
High	0.6	golang.org/x/net	go-module	v0.49.0	0.53.0	GO-2026-4918	freelens/dist/win-unpacked/resources/x64/kubectl.exe
High	0.5	golang.org/x/net	go-module	v0.49.0	0.55.0	GO-2026-5026	freelens/dist/win-unpacked/resources/x64/kubectl.exe
High	0.5	stdlib	go-module	go1.26.5	1.25.13, 1.26.6, 1.27.0-rc.3	GO-2026-5026	freelens/dist/win-unpacked/resources/x64/kubectl.exe
High	0.4	stdlib	go-module	go1.26.5	1.25.13, 1.26.6, 1.27.0-rc.3	GO-2026-6089	freelens/dist/win-unpacked/resources/x64/kubectl.exe
High	0.4	stdlib	go-module	go1.26.5	1.25.13, 1.26.6, 1.27.0-rc.3	GO-2026-5972	freelens/dist/win-unpacked/resources/x64/kubectl.exe
High	0.4	stdlib	go-module	go1.26.5	1.25.13, 1.26.6, 1.27.0-rc.3	GO-2026-6088	freelens/dist/win-unpacked/resources/x64/kubectl.exe
High	0.4	stdlib	go-module	go1.26.5	1.25.13, 1.26.6, 1.27.0-rc.3	GO-2026-6090	freelens/dist/win-unpacked/resources/x64/kubectl.exe
High	0.4	golang.org/x/net	go-module	v0.49.0	0.56.0	GO-2026-5942	freelens/dist/win-unpacked/resources/x64/kubectl.exe
High	0.4	stdlib	go-module	go1.26.5	1.26.6, 1.27.0-rc.3	GO-2026-5942	freelens/dist/win-unpacked/resources/x64/kubectl.exe
High	0.4	golang.org/x/text	go-module	v0.33.0	0.39.0	GO-2026-5970	freelens/dist/win-unpacked/resources/x64/kubectl.exe
High	0.3	fast-uri	npm	3.1.3	3.1.4	GHSA-v2hh-gcrm-f6hx	node_modules/.pnpm/fast-uri@3.1.3/node_modules/fast-uri
High	0.3	oras.land/oras-go/v2	go-module	v2.6.1	2.6.2	GHSA-fxhp-mv3v-67qp	freelens/dist/win-unpacked/resources/x64/helm.exe
High	0.3	golang.org/x/crypto	go-module	v0.54.0	0.56.0	GO-2026-6355	freelens/dist/win-unpacked/resources/x64/helm.exe
High	0.3	ip-address	npm	9.0.5	10.3.1	GHSA-mwp4-54f8-5fhr	node_modules/.pnpm/ip-address@9.0.5/node_modules/ip-address
High	0.2	golang.org/x/crypto	go-module	v0.54.0	0.55.0	GO-2026-6303	freelens/dist/win-unpacked/resources/x64/helm.exe
High	0.2	golang.org/x/crypto	go-module	v0.54.0	0.56.0	GO-2026-6354	freelens/dist/win-unpacked/resources/x64/helm.exe
High	0.2	fast-uri	npm	3.1.3	3.1.6	GHSA-5jgf-p345-68v8	node_modules/.pnpm/fast-uri@3.1.3/node_modules/fast-uri
High	0.2	fast-uri	npm	3.1.3	3.1.6	GHSA-jqff-g426-hqxp	node_modules/.pnpm/fast-uri@3.1.3/node_modules/fast-uri
High	0.2	fast-uri	npm	3.1.3	3.1.5	GHSA-7p8r-x3mc-p8w7	node_modules/.pnpm/fast-uri@3.1.3/node_modules/fast-uri
High	0.2	fast-uri	npm	3.1.3	3.1.6	GHSA-f65p-4m7j-42xc	node_modules/.pnpm/fast-uri@3.1.3/node_modules/fast-uri
High	0.2	fast-uri	npm	3.1.3	3.1.6	GHSA-fph4-wmhf-6fwf	node_modules/.pnpm/fast-uri@3.1.3/node_modules/fast-uri
High	0.0	js-yaml	npm	4.3.0	4.3.1	GHSA-5p4m-2wfm-xmqj	node_modules/.pnpm/js-yaml@4.3.0/node_modules/js-yaml
Medium	0.3	stdlib	go-module	go1.26.5	1.25.13, 1.26.6, 1.27.0-rc.3	GO-2026-6218	freelens/dist/win-unpacked/resources/x64/kubectl.exe
Medium	0.2	ip-address	npm	9.0.5	10.1.1	GHSA-v2v4-37r5-5v8g	node_modules/.pnpm/ip-address@9.0.5/node_modules/ip-address
Medium	0.2	yaml	npm	1.10.2	1.10.3	GHSA-48c2-rrv3-qjmp	node_modules/.pnpm/yaml@1.10.2/node_modules/yaml
Medium	0.2	golang.org/x/net	go-module	v0.49.0	0.55.0	GHSA-5cv4-jp36-h3mw	freelens/dist/win-unpacked/resources/x64/kubectl.exe
Medium	0.2	go.opentelemetry.io/otel	go-module	v1.41.0	1.42.0, 1.44.0	GO-2026-5158	freelens/dist/win-unpacked/resources/x64/kubectl.exe
Medium	0.2	stdlib	go-module	go1.26.5	1.25.13, 1.26.6, 1.27.0-rc.3	GO-2026-6091	freelens/dist/win-unpacked/resources/x64/kubectl.exe
Medium	0.1	golang.org/x/net	go-module	v0.49.0	0.55.0	GO-2026-5025	freelens/dist/win-unpacked/resources/x64/kubectl.exe
Medium	0.1	golang.org/x/net	go-module	v0.49.0	0.55.0	GO-2026-5030	freelens/dist/win-unpacked/resources/x64/kubectl.exe
Medium	0.1	golang.org/x/net	go-module	v0.49.0	0.55.0	GO-2026-5027	freelens/dist/win-unpacked/resources/x64/kubectl.exe
Medium	0.1	golang.org/x/net	go-module	v0.49.0	0.55.0	GO-2026-5029	freelens/dist/win-unpacked/resources/x64/kubectl.exe
Medium	0.1	dompurify	npm	3.4.8	3.4.11	GHSA-cmwh-pvxp-8882	node_modules/.pnpm/dompurify@3.4.8/node_modules/dompurify
Medium	0.0	dompurify	npm	3.4.12	3.4.13	GHSA-55q2-fjhq-7xh7	node_modules/.pnpm/dompurify@3.4.12/node_modules/dompurify
Medium	0.0	dompurify	npm	3.4.8	3.4.13	GHSA-55q2-fjhq-7xh7	node_modules/.pnpm/dompurify@3.4.8/node_modules/dompurify
Medium	0.0	follow-redirects	npm	1.15.9	1.16.0	GHSA-r4q5-vmmm-2653	node_modules/.pnpm/follow-redirects@1.15.9_debug@4.4.3_supports-color@8.1.1_/node_modules/follow-redirects
Low	0.1	k8s.io/kubernetes	go-module	v1.36.3		GO-2025-3547	freelens/dist/win-unpacked/resources/x64/kubectl.exe
Low	0.1	dompurify	npm	3.4.8	3.4.9	GHSA-vxr8-fq34-vvx9	node_modules/.pnpm/dompurify@3.4.8/node_modules/dompurify
Low	0.0	golang.org/x/sys	go-module	v0.40.0	0.44.0	GO-2026-5024	freelens/dist/win-unpacked/resources/x64/kubectl.exe
Low	0.0	dompurify	npm	3.4.8	3.4.12	GHSA-c2j3-45gr-mqc4	node_modules/.pnpm/dompurify@3.4.8/node_modules/dompurify
Unknown	0.0	golang.org/x/crypto	go-module	v0.54.0		GO-2026-5932	freelens/dist/win-unpacked/resources/x64/helm.exe

[farfromexact]

The scan is actionable, and the locations show that these are not all the same dependency problem.

The golang.org/x/net and golang.org/x/text findings are inside the bundled kubectl.exe, while the oras-go finding is inside the bundled helm.exe. Updating the application package's own Go dependencies will not change those embedded tools; the tools need to be rebuilt or replaced with upstream versions that contain the fixed modules. After rebuilding, verify the binary module metadata and scan the actual packaged executable again.

The fast-uri, ip-address, and yaml findings are in the packaged Node dependency tree, so those should be handled through the lockfile and the application build. The important verification target is the final win-unpacked/resources tree, not only the source workspace.

I would track the remediation as separate artifacts:

1. Rebuild or update kubectl and rescan kubectl.exe.
2. Rebuild or update helm and rescan helm.exe.
3. Update the Node lockfile and rescan the packaged app.
4. Publish the scan against the exact commit and artifact users will download.

For each advisory, record whether the vulnerable code is reachable in the shipped feature and whether an upstream fixed version is available, but do not suppress a high finding just because it is in a helper binary. The scan is valuable precisely because bundled tools become part of the user's attack surface.

[dex4er]

Thanks for the breakdown, but most of the recommendations do not apply here.

We already bundle the latest upstream releases. kubectl 1.36.3 and helm 4.2.3
are the current latest from kubernetes/kubernetes and helm/helm. There is no newer
upstream build vendoring a fixed x/net or x/text - those releases ship exactly
these module versions. The oras-go advisory (GHSA-fxhp-mv3v-67qp) has no patched
version at all.

Rebuilding the tools ourselves is not something we want. We just built the machinery for verification of the supply chain, and breaking it with our own rebuilds is not the right solution: it would be a downgrade for the security, not a fix.

The scan already targets the packaged artifact. The report links the exact commit
and run, and the locations point at exact files that users download.

Grype reads the Go build info module list, not linked symbols,
so it reports every module in the dependency graph regardless of whether the
vulnerable code is even present.

The npm findings are ours and will be handled through the lockfile.

One process note: please do not paste unreviewed agent output into this repository.
Several claims above are wrong for this project, and checking them took longer than
writing the comment did. Analysis is welcome - verified analysis.