Fix/image CVE refresh - #744
Merged
Merged
Conversation
Clears the 25 HIGH/CRITICAL gemspec findings from #743 (local rebuild + Trivy: 0 gemspec findings; total 47->17, remainder are out-of-scope UBI9 OS packages). Gems (bundle update within existing constraints, no majors; bundler-audit clean): concurrent-ruby 1.3.8, faraday 1.10.6, oj 3.17.4, websocket-driver 0.8.2, crass 1.0.7, json 2.21.1, loofah 2.25.2, msgpack 1.8.3, rails-html-sanitizer 1.7.1. faraday pinned '~> 1.10', '>= 1.10.6' (CVE-2026-54297) since bundle update mis-resolves the transitive gem down to 1.3.1. Toolchain: Ruby 3.4.9->3.4.10 (patched default gems erb 4.0.4.1 / net-imap 0.5.15, CVE-2026-41316 + net-imap advisories), Node 24.14.0->24.18.0, yarn upgrade within package.json ranges. Build (incorporates #739): base image digest-pinned, tar --no-same-owner, combined COPY -- required to build under Docker Enhanced Container Isolation. Signed-off-by: Will <will@dower.dev>
Signed-off-by: Will <will@dower.dev>
aaronlippold
previously approved these changes
Jul 28, 2026
The gem-CVE remediation bumped Ruby to 3.4.10 in Gemfile/Gemfile.lock/ Dockerfile but left CI-facing pins at 3.4.9: - .ruby-version / .tool-versions drove setup-ruby to install 3.4.9, aborting bundle install (Gemfile specifies 3.4.10). - docker-bake.hcl passed RUBY_VERSION=3.4.9 as a build-arg against the Dockerfile's 3.4.10 SHA256, failing the tarball checksum. Sync all pins to 3.4.10 (and bake node default to 24.18.0 to match the Dockerfile ARG). Signed-off-by: Will <will@dower.dev>
ruby/setup-ruby installs prebuilt binaries from ruby-builder, which has no 3.4.10 build yet (source tarball exists; only compilation works). The docker job already builds Ruby from source, but lint/backend fail at setup with 'Unknown version 3.4.10 for ruby on ubuntu-24.04'. Add a composite action that compiles the pinned Ruby from source (mirroring the Dockerfile: source fetch + SHA256 verify + configure/make /install), caching both the compiled Ruby and the gem bundle. Wire lint and backend to it so CI tests on the same 3.4.10 the image ships. Temporary: revert to ruby/setup-ruby once ruby-builder publishes a 3.4.10 binary. Timeouts bumped to cover a one-time cold compile. Signed-off-by: Will <will@dower.dev>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
bootsnap 1.18.6 mis-detects Ruby bug #22023 on 3.4.x patch releases, so RubyVM::InstructionSequence#to_binary raises 'should not compile with coverage' at boot when SimpleCov is active, crashing every backend CI shard on Ruby 3.4.10. 1.24.6 fixes the detection and applies the workaround. Lockfile-only (Gemfile already allows >= 1.4.2). Signed-off-by: Will <will@dower.dev>
bundler-audit flags CVE-2026-66066 (arbitrary file read + RCE in Active Storage variant processing) against activestorage 8.0.5. Rails 8.0.5.1 is the fixed release. Lockfile-only (Gemfile already allows ~> 8.0.0). Signed-off-by: Will <will@dower.dev>
Contributor
Author
|
Note that a large number of bump updates to gems in this PR needed Ruby 3.4.10, which hasn't wended its way to being installable by GH actions yet. I have therefore stopped using GH actions for the Ruby install step and borrowed the Dockerfile's Ruby setup, which just pulls and installs up-to-date Ruby directly. This keeps parity between the container build CI and the regular CI, and lets us actually close the dependency issues we're trying to get at with this branch. Later, when 3.4.10 is available through the GH action for Ruby installation, we can determine if we want to go back to that flow. |
Add --proto '=https' --proto-redir '=https' to every build-time curl so it refuses any non-HTTPS hop, including redirects, closing the transport downgrade vector SonarCloud S6506 flags (downloads are already SHA256- verified). Covers the Ruby, jemalloc, and Node fetches in the Dockerfile and the Ruby fetch in the CI source-build action. Signed-off-by: Will <will@dower.dev>
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps all dependencies we can bump without changing a major version pin to cut down on Trivy findings (run locally, not currently set up in CI/CD).
Also folds in some of the Dockerfile fixes needed to get the container to launch on a Docker ECI host.