Skip to content

fix: upgrade vulnerable dependencies (AST-108828,AST-116271,AST-120967,AST-123298,AST-123300,AST-123302,AST-123980,AST-123981,AST-132239,AST-134898)#40

Open
cx-adar-zandberg wants to merge 4 commits intomainfrom
fix/security-vulnerabilities-AST-108828-AST-123298-and-more
Open

fix: upgrade vulnerable dependencies (AST-108828,AST-116271,AST-120967,AST-123298,AST-123300,AST-123302,AST-123980,AST-123981,AST-132239,AST-134898)#40
cx-adar-zandberg wants to merge 4 commits intomainfrom
fix/security-vulnerabilities-AST-108828-AST-123298-and-more

Conversation

@cx-adar-zandberg
Copy link
Contributor

@cx-adar-zandberg cx-adar-zandberg commented Mar 4, 2026

Fixed Vulnerabilities

Ticket CVE Severity Component
AST-108828 CVE-2025-46569 HIGH github.com/open-policy-agent/opa
AST-116271 CVE-2025-27144 - gopkg.in/go-jose/go-jose.v2
AST-120967 CVE-2024-25621 - github.com/containerd/containerd/v2
AST-123298 CVE-2025-52881 HIGH github.com/opencontainers/runc
AST-123300 CVE-2025-52565 HIGH github.com/opencontainers/runc
AST-123302 CVE-2025-31133 HIGH github.com/opencontainers/runc
AST-123980 CVE-2025-64329 - github.com/containerd/containerd/v2
AST-123981 CVE-2019-25210 - helm.sh/helm/v3
AST-132239 CVE-2026-24137 - github.com/sigstore/sigstore
AST-134898 CVE-2026-25934 - github.com/go-git/go-git/v5

Changes Made

Compatibility pins: tablewriter v0.0.5 (syft), runtime-spec v1.2.1 (containerd compatibility).

Made with Cursor

@cx-adar-zandberg
fix: upgrade vulnerable dependencies (AST-108828, AST-116271, AST-120…
88cb402 
…967, AST-123298, AST-123300, AST-123302, AST-123980, AST-123981, AST-132239, AST-134898)

Made-with: Cursor
@cx-adar-zandberg cx-adar-zandberg changed the title fix: upgrade vulnerable dependencies fix: upgrade vulnerable dependencies (AST-108828,AST-116271,AST-120967,AST-123298,AST-123300,AST-123302,AST-123980,AST-123981,AST-132239,AST-134898) Mar 4, 2026
@cx-shaked-karta
Copy link
Contributor

cx-shaked-karta commented Mar 4, 2026 •
edited
Loading

Logo
Checkmarx One – Scan Summary & Details – 92a8abdd-951c-417e-9007-b5a4fb1e7770

Fixed Issues (1) Great job! The following issues were fixed in this Pull Request
Severity Issue Source File / Package
MEDIUM CVE-2026-25934 Go-github.com/go-git/go-git/v5-v5.14.0

Use @Checkmarx to interact with Checkmarx PR Assistant.
Examples:
@Checkmarx how are you able to help me?
@Checkmarx rescan this PR

@cx-adar-zandberg
revert go to 1.24
f0e48af
@cx-adar-zandberg
revert helm to v3.19.2; accept CVE-2019-25210 as not applicable
c925b94 
Downgrade helm.sh/helm/v3 from v3.20.0 back to v3.19.2. CVE-2019-25210
only affects helm's --dry-run flag which this codebase never uses, so
upgrading solely to address it provides no security benefit. Go directive
kept at 1.24.13; go.sum updated accordingly.

Made-with: Cursor
@cx-adar-zandberg
remove vuls fix file
4946ddb
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@cx-adar-zandberg @cx-shaked-karta