Repository navigation
chore(trivy): ignore CVE-2026-102633 until Alpine 3.24 ships libexpat 2.9.0 - #562
Merged
Neophytis merged 1 commit intoOct 8, 2026
Merged
Conversation
… 2.9.0 The fix (libexpat 2.9.0-r0) exists only in Alpine edge; 3.24-stable still ships 2.8.5-r0, so the daily apk refresh cannot pick it up and every image scan fails, which blocks the stage auto-deploy and the prod release job. Only git depends on libexpat in the image (PHP XML uses libxml2).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Target branch:
feature/docker-master.Why
Since 2026-10-08, every image build fails Scan image on CVE-2026-102633 (libexpat, MEDIUM, DoS). This blocks the stage auto-deploy and the prod Create GitHub release job, which both depend on the scan.
libexpat 2.9.0-r0, exists only in Alpine edge (edge secdb lists it).php:8.3.33-fpm-alpine3.24) still ships2.8.5-r0. The 3.24-stable APKBUILD is unchanged, and the 3.24 secdb has no entry.apk upgrade(APK_REFRESH, fix(docker): refresh apk packages daily despite the layer cache; drop unused python3 #538) ran today but has nothing newer to install.ignore-unfixeddoesn't skip it.This is the case
.trivyignoreis for ("no fixed package available yet"), the same as the nghttp2 entry that #539 removed.Exposure
Minimal. Only
gitdepends on libexpat in the image (apk info -r libexpat→git). PHP's XML extensions use libxml2 2.13.9, and git only uses expat for WebDAV pushes, which nothing in the container does.Test
A stage image build on this branch (
sha-f9f7784, before the comment-only amend) passed every job, including Scan image.Removal
Remove the line once Alpine 3.24 ships
libexpat >= 2.9.0-r0. The daily refresh then picks it up automatically.Unblocks #561 and the next prod release.