MOB-51904: CVE fixes - 2026-07-14

[RafaelGuevaraCA]

Jira: MOB-51904

Fixable in taurus, this run: 3 detected → 3 fixed. (distinct CVEs this repo's own Dockerfile fixes cleared, confirmed gone in the branch image scan)

Verified against the taurus-branch-builder image scan (build #576) before opening — integration passed.

✅ Fixed (old version gone in branch scan #576)

CVE	Severity	Package	Old → New
CVE-2026-14324	medium	pipewire	1.0.5-1ubuntu3.2 → 1.0.5-1ubuntu3.3
CVE-2026-14330	medium	pipewire	1.0.5-1ubuntu3.2 → 1.0.5-1ubuntu3.3
CVE-2026-45591	low	asp.net-core (.NET runtime)	8.0.26 → 8.0.28

Fix mechanism

• pipewire — added to the existing apt-get --only-upgrade block in the system-deps stage (unpinned, so it tracks the security pocket).
• asp.net-core — bumped the .NET SDK tarball 8.0.420 → 8.0.422 (DOTNET_URL + DOTNET_SHA512), and updated the .deps.json sed-patch paths to the new SDK version.

Local code review (pre-push)

An independent /code-review pass (high effort) surfaced 2 verification-completeness risks, both consciously deferred to the branch re-scan and both refuted by it:

1. Roslyn .deps.json sed targets might not match 8.0.422's Roslyn versions → refuted: the branch scan shows 0 Roslyn/dotnet rows (no new finding introduced).
2. pipewire fix might miss the vulnerable binary → refuted: pipewire 1.0.5-1ubuntu3.2 is fully gone from the branch scan.

No code changes were applied from the review (no confirmed defect; speculative edits would have been guesswork).

Fixable but deferred for cause (not in this PR)

• setuptools CVE-2026-59890, wheel CVE-2026-24049, jaraco.context CVE-2026-23949 — all blocked by the setup.py pkg_resources coupling: clearing them requires setuptools ≥ 82/83 which removes pkg_resources, breaking the no-build-isolation wheel build (setup.py:16 still import pkg_resources). The real unblock is a separate PR refactoring setup.py onto packaging.requirements — it would clear all three at once.
• file-type CVE-2022-36313 (Newman) — 3 → 16 breaking ESM major jump; an override breaks Newman's dependency tree.
• diff CVE-2026-24001 (mocha) — mocha@11 pins diff ^7; the fix crosses a major for a single LOW.

Not actionable in this repo (count only)

pip 24.0 (distro apt can't reach 26.1.2) + monitor-only JMeter/Gatling bundled jars, Ubuntu ESM, k6 binary internals, no-released-patch, and scanner-appeasement findings. Criticals this run: all 4 are monitor-only JMeter/Gatling bundled jars (Apache Tika) — none fixable here.

Raw scan (reconciliation only): baseline #178 278 → branch #576 259 [crit 4→4, high 44→43, medium 169→165, low 48→47]. Distinct-CVE counts differ from per-occurrence totals — context, not a checksum.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Updates the build image to remediate newly detected CVEs by upgrading vulnerable OS packages (pipewire) and bumping the bundled .NET SDK used in the Docker image, plus recording the new setuptools-related deferral rationale in the vulnerability history notes.

Changes:

• Extend the apt-get --only-upgrade security block to upgrade pipewire and related packages to patched Ubuntu versions.
• Bump .NET SDK download from 8.0.420 → 8.0.422 (URL + SHA512) and update the related .deps.json patch paths to match the new SDK directory.
• Document that the existing pkg_resources coupling now blocks a direct setuptools CVE bump (in addition to the vendored wheel/jaraco.context findings).

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
Dockerfile	Upgrades pipewire packages and bumps .NET SDK version/hash; updates dotnet metadata patch paths accordingly.
.claude/skills/prisma-taurus/vulnerability_history.md	Adds an explanatory note about the setuptools CVE deferral due to pkg_resources coupling in setup.py.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 88.08%. Comparing base (7257724) to head (8143a1a).

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #2006   +/-   ##
=======================================
  Coverage   88.08%   88.08%           
=======================================
  Files          73       73           
  Lines       20935    20935           
=======================================
  Hits        18439    18439           
  Misses       2496     2496           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.