fix(container): bump PowerShell to 7.5.11 in SDK and API - #12811
Conversation
|
✅ All required changelog fragments are present. |
|
✅ No Conflicts No conflict markers, and the branch merges cleanly into its base. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Advanced Run ID: 📒 Files selected for processing (5)
💤 Files with no reviewable changes (1)
Included review availability: Your plan provides up to 10 included reviews per hour; 7 remain after this review. 📝 WalkthroughWalkthroughThe root and API Dockerfiles now use PowerShell 7.5.11 with matching checksums. Changelog entries record the update. Two expired Trivy suppressions were removed. ChangesSecurity image maintenance
Priority: ➖ Normal Estimated code review effort: 2 (Simple) | ~10 minutes Suggested reviewers: Merge Risk: ⚪ Minimal · up to The PR updates both container images to PowerShell 7.5.11 with matching checksums and removes expired vulnerability suppressions; no merge-blocking risk is identified. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
🔒 Container Security ScanImage: ✅ No Vulnerabilities DetectedThe container image passed all security checks. No known CVEs were found.📋 Resources:
|
🔎 Container Security Scan (Grype)Image: ✅ Nothing BlockingNo findings at critical or high severity. Not blocking at this cutoff — medium: 8, low: 4. 3 finding(s) excluded by 📋 Resources:
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
🔒 Container Security ScanImage: ✅ No Vulnerabilities DetectedThe container image passed all security checks. No known CVEs were found.📋 Resources:
|
🔎 Container Security Scan (Grype)Image: ✅ Nothing BlockingNo findings at critical or high severity. 📋 Resources:
|
🔒 Container Security ScanImage: ✅ No Vulnerabilities DetectedThe container image passed all security checks. No known CVEs were found.📋 Resources:
|
🔎 Container Security Scan (Grype)Image: ✅ Nothing BlockingNo findings at critical or high severity. Not blocking at this cutoff — medium: 24, low: 9, negligible: 1. 65 finding(s) excluded by 📋 Resources:
|
🔒 Container Security ScanImage: ✅ No Vulnerabilities DetectedThe container image passed all security checks. No known CVEs were found.📋 Resources:
|
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #12811 +/- ##
===========================================
+ Coverage 54.34% 94.71% +40.36%
===========================================
Files 1337 272 -1065
Lines 82828 42322 -40506
===========================================
- Hits 45017 40085 -4932
+ Misses 37811 2237 -35574 Flags with carried forward coverage won't be shown. Click here to find out more.
🚀 New features to boost your workflow:
|
🔎 Container Security Scan (Grype)Image: ✅ Nothing BlockingNo findings at critical or high severity. Not blocking at this cutoff — medium: 20, low: 5, negligible: 1. 80 finding(s) excluded by 📋 Resources:
|
prowler-bot
added
the
was-backported
💚 All backports created successfully
Questions ?Please refer to the Backport tool documentation and see the Github Action logs for details |
3 participants
Context
The SDK and API container checks fail at "Check for blocking vulnerabilities" with
HIGH CVE-2026-62901 Microsoft.NETCore.App.Runtime.linux-x64 9.0.18, a denial of service inSystem.Net.WebSocketsfixed in .NET 9.0.19. That runtime ships inside the PowerShell 7.5.9 tarball both images install. The finding was suppressed in.trivyignore.yamlbecause no PowerShell release carried the fix, withexpired_at: 2026-09-15. The suppression expired today, so every PR that runs the container scan now fails, includingbackport/v5.41/pr-12717. PowerShell 7.5.10 and 7.5.11 have been released since then with the patched runtime.Description
Bumps PowerShell from 7.5.9 to 7.5.11 in
Dockerfileandapi/Dockerfile. The 7.5.11 tarballs bundle .NET runtime 9.0.20 on bothlinux-x64andlinux-arm64, as declared inpwsh.deps.json, which is what Trivy reads. The bump stays on the 7.5 line the M365 PowerShell modules target (see #12698). The new SHA256 values were computed from the downloaded tarballs and match both the release notes and the GitHub asset digests.The expired CVE-2026-62901 suppression is removed. The CVE-2026-71556 (go-git) suppression expired the same day and is also removed: Trivy 0.74.0, the version the images ship, already pins go-git 5.19.2, so the entry no longer matches anything.
A changelog fragment is added for each image (SDK and API).
Steps to review
Check the bundled runtime and scan the new tarball with the flags the container checks use:
The scan reports no HIGH or CRITICAL findings. Running the same scan against the 7.5.9 tarball reproduces CVE-2026-62901, and the arm64 tarball gives the same clean result.
sdk-container-checksandapi-container-checkson this PR build both images and run the full scan.Checklist
Community Checklist
SDK/CLI
UI
API
MCP Server
License
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
Summary by CodeRabbit
Security
Maintenance