UID2-7794: bump base image digest and drop redundant .trivyignore entries - #672
Merged
Merged
Conversation
…ries uid2-admin was the only service still pinned to eclipse-temurin sha256:3f08b138... UID2-7760 moved uid2-core, uid2-optout, uid2-operator, uid2-snowflake and uid2-validator onto sha256:319339a7... — a newer build of the same 21-jre-alpine-3.23 tag that ships fixed Alpine packages — but this repo was missed. The CVE-2026-2100 (p11-kit) suppression carried exp:2026-09-01 and expired today, turning the scheduled scan red. Rather than extend it, this brings uid2-admin in line with the other five repos. A Trivy probe of the two digests (OS packages, HIGH/CRITICAL) shows the newer one clears four of the five findings: sha256:3f08b138... CVE-2026-2100, 56408, 11822, 11824, 14456 sha256:319339a7... CVE-2026-14456 only CVE-2026-14456 (libcrypto3/libssl3) does not surface here because the Dockerfile already apk-upgrades libcrypto3 and libssl3 explicitly. The four suppressions the bump makes redundant are removed: CVE-2026-2100 (p11-kit), CVE-2026-56408 (libexpat) and CVE-2026-11822/11824 (sqlite-libs). None were reachable from this service in the first place — it is a pure-Java Vert.x application with no JNI or native PKCS#11 bindings — so this is suppression-debt cleanup rather than an exploitability fix.
BehnamMozafari
approved these changes
Sep 1, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Bumps the pinned
eclipse-temurinbase image digest fromsha256:3f08b138...tosha256:319339a7...— a newer build of the same21-jre-alpine-3.23tag — and removes the four.trivyignoreentries the bump makes redundant.Why
uid2-adminwas the only service still on the old digest.uid2-core,uid2-optout,uid2-operator,uid2-snowflakeanduid2-validatorwere all moved ontosha256:319339a7...previously; this repo was missed.The
CVE-2026-2100(p11-kit) suppression carriedexp:2026-09-01and expired today, turning the scheduled vulnerability scan red. Rather than extend it for another three months, this applies the fix that already exists and is deployed elsewhere.A Trivy probe of the two digests (OS packages, HIGH/CRITICAL) shows the newer one clears four of the five findings:
sha256:3f08b138...(current)sha256:319339a7...(this PR)CVE-2026-14456(libcrypto3/libssl3) does not surface here because the Dockerfile alreadyapk addslibcrypto3andlibssl3explicitly.Suppressions removed
CVE-2026-2100— p11-kitCVE-2026-56408— libexpatCVE-2026-11822/CVE-2026-11824— sqlite-libsNone were reachable from this service to begin with — it is a pure-Java Vert.x application with no JNI or native PKCS#11 bindings — so this is suppression-debt cleanup rather than an exploitability fix. The remaining entries (
CVE-2026-42577netty,CVE-2026-40984micrometer, and the two long-standing false positives) are Java-dependency findings unaffected by the base image and are left in place.Verification
The Vulnerability Scan job on this PR is the check that matters — it scans the built image and should come back clean for all four removed entries.