jlxq0/matrix-mcp
Watch
1
0
Fork
You've already forked matrix-mcp
 0
Code Issues 13 Pull requests Projects Releases 1 Packages 1 Wiki Activity Actions

fix(docker): repin distroless cc-debian13 for zlib1g CVE-2026-76844/85091 #160

Merged
jlxq0 merged 1 commit from fix/distroless-zlib into main 2026-11-09 03:04:29 +00:00
Conversation 0 Commits 1 Files changed 2 +15 -1
jlxq0 commented 2026-11-09 02:58:04 +00:00
Owner

The final-image Trivy gate refused to publish v0.10.19 (run 19373): the pinned gcr.io/distroless/cc-debian13:nonroot@sha256:3ee00291… ships zlib1g 1:1.3.dfsg+really1.3.1-1+b1, which has CVE-2026-76844 and CVE-2026-85091 (both HIGH, fixed upstream).

This repins the base to the current nonroot index sha256:cc66d222f0a7ec996b78a99fe76a969bc80b539a5016ad866c14d1949bc6d0ab. Its amd64 var/lib/dpkg/status.d/zlib1g reads 1:1.3.dfsg+really1.3.1-1+deb13u1. Changelog: a v0.10.20 section that says the v0.10.19 tag has no image.

PR CI doesn't run the docker job. The push to main builds and scans the image, and that run is the gate before tagging v0.10.20.

🤖 Generated with Claude Code

https://claude.ai/code/session_01E2xQRZnoBbY9SEC5nF6J4U

The final-image Trivy gate refused to publish `v0.10.19` (run 19373): the pinned `gcr.io/distroless/cc-debian13:nonroot@sha256:3ee00291…` ships `zlib1g 1:1.3.dfsg+really1.3.1-1+b1`, which has CVE-2026-76844 and CVE-2026-85091 (both HIGH, fixed upstream). This repins the base to the current nonroot index `sha256:cc66d222f0a7ec996b78a99fe76a969bc80b539a5016ad866c14d1949bc6d0ab`. Its amd64 `var/lib/dpkg/status.d/zlib1g` reads `1:1.3.dfsg+really1.3.1-1+deb13u1`. Changelog: a `v0.10.20` section that says the `v0.10.19` tag has no image. PR CI doesn't run the docker job. The push to `main` builds and scans the image, and that run is the gate before tagging `v0.10.20`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01E2xQRZnoBbY9SEC5nF6J4U
fix(docker): repin distroless cc-debian13 for zlib1g CVE-2026-76844/85091
All checks were successful
CI / cargo (pull_request) Successful in 5m48s
Details
CI / docker (pull_request) Has been skipped
Details
a337f0e93b
 
The final-image Trivy gate refused to publish v0.10.19: the pinned base
shipped zlib1g 1:1.3.dfsg+really1.3.1-1+b1 with two HIGH CVEs. The current
nonroot index (sha256:cc66d222...) ships 1:1.3.dfsg+really1.3.1-1+deb13u1.
Releases as v0.10.20.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E2xQRZnoBbY9SEC5nF6J4U
jlxq0 merged commit 381e467e3a into main 2026-11-09 03:04:29 +00:00
jlxq0 deleted branch fix/distroless-zlib 2026-11-09 03:04:30 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
blocked
Held on a named, checkable blocker: an issue number, a credential or a measurement. Not "held".

  
bug
Something isn't working

  
documentation
Improvements or additions to documentation

  
duplicate
This issue or pull request already exists

  
enhancement
New feature or request

  
good first issue
Good for newcomers

  
help wanted
Extra attention is needed

  
invalid
This doesn't seem right

  
question
Further information is requested

  
waiting-on-julian
Blocked on Julian. The ask is in the issue.

  
wontfix
This will not be worked on

No labels
blocked
bug
documentation
duplicate
enhancement
good first issue
help wanted
invalid
question
waiting-on-julian
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
jlxq0/matrix-mcp!160
No description provided.