`steampipe_export_aws` binary ships with critical/high CVEs — please rebuild with updated Go toolchain and dependencies

[rokkarinn]

Title

steampipe_export_aws binary ships with critical/high CVEs — please rebuild with updated Go toolchain and dependencies

---

Body

Summary

The pre-built steampipe_export_aws binary distributed in the v1.30.2 release contains several critical and high severity CVEs due to outdated Go module dependencies and an outdated Go toolchain version (go1.26.1). We discovered these via AWS ECR's enhanced scanning (Amazon Inspector).

Since we consume the binary as-is (downloaded from the GitHub release artifact), we have no way to patch these ourselves without building from source.

We'd like to request a rebuild of the binary against an updated Go toolchain and bumped dependencies.

---

CVE details

Critical

CVE	Package	Bundled version	Fixed in
CVE-2026-33186	google.golang.org/grpc	v1.67.3	v1.79.3
CVE-2026-33815	github.com/jackc/pgx/v5	v5.6.0	v5.9.0
CVE-2026-33816	github.com/jackc/pgx/v5	v5.6.0	v5.9.0

High

CVE	Package	Bundled version	Fixed in
CVE-2026-33811	go/stdlib	1.26.1	1.26.3
CVE-2026-33814	go/stdlib + golang.org/x/net	1.26.1	1.26.3
CVE-2026-32280	go/stdlib	1.26.1	1.26.2
CVE-2026-32281	go/stdlib	1.26.1	1.26.2
CVE-2026-32283	go/stdlib	1.26.1	1.26.2
CVE-2026-33810	go/stdlib	1.26.1	1.26.2
CVE-2026-39820	go/stdlib	1.26.1	1.26.3
CVE-2026-39836	go/stdlib	1.26.1	1.26.3
CVE-2026-42499	go/stdlib	1.26.1	1.26.3
CVE-2025-47913	golang.org/x/crypto	v0.36.0	v0.43.0
CVE-2026-4660	github.com/hashicorp/go-getter	v1.7.9	v1.8.6
CVE-2026-24051	go.opentelemetry.io/otel/sdk	v1.29.0	v1.40.0
CVE-2026-39883	go.opentelemetry.io/otel/sdk	v1.29.0	v1.43.0
CVE-2024-25621	github.com/containerd/containerd	v1.7.27	v1.7.29
GHSA-389r-gv7p-r3rp	github.com/go-git/go-git/v5	v5.13.0	v5.19.0
CVE-2026-41506	github.com/go-git/go-git/v5	v5.13.0	v5.18.0

All findings are in /usr/local/bin/steampipe_export_aws (confirmed via Amazon Inspector's file-path attribution).

---

What we've already tried

• Upgraded from v1.30.0 → v1.30.2 — the Alpine OS-level openssl CVE was resolved, but all Go module/toolchain CVEs remain unchanged.
• There is nothing we can patch in our Dockerfile since the vulnerabilities are embedded inside the distributed binary.

---

Requested action

1. Bump Go toolchain to at least go1.26.3 (or current latest stable)
2. Run go get / go mod tidy to pull in patched versions of the affected modules, particularly:
   • google.golang.org/grpc ≥ v1.79.3
   • github.com/jackc/pgx/v5 ≥ v5.9.0
   • golang.org/x/crypto ≥ v0.43.0
   • github.com/hashicorp/go-getter ≥ v1.8.6
   • go.opentelemetry.io/otel/sdk ≥ v1.43.0
   • github.com/go-git/go-git/v5 ≥ v5.19.0
   • github.com/containerd/containerd ≥ v1.7.29
3. Publish a new patch release so consumers can pick up the fixed binary without building from source

---

Environment

• Binary: steampipe_export_aws linux/amd64
• Release: v1.30.2
• Scanner: AWS ECR enhanced scanning (Amazon Inspector v2)
• Container base: alpine:3.21

[github-actions]

This issue is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 30 days.