Fix: OSV scanner docker/docker CVE#3954
Merged
Merged
Conversation
szuecs
force-pushed
the
fix/osv-scanner-moby-cve
branch
from
April 9, 2026 20:21
511a664 to
07277b4
Compare
…ding on old version of moby Signed-off-by: Sandor Szücs <sandor.szuecs@zalando.de>
Signed-off-by: Sandor Szücs <sandor.szuecs@zalando.de>
Signed-off-by: Sandor Szücs <sandor.szuecs@zalando.de>
Signed-off-by: Sandor Szücs <sandor.szuecs@zalando.de>
Signed-off-by: Sandor Szücs <sandor.szuecs@zalando.de>
Signed-off-by: Sandor Szücs <sandor.szuecs@zalando.de>
szuecs
force-pushed
the
fix/osv-scanner-moby-cve
branch
from
April 10, 2026 17:13
aa85e32 to
4cb3e56
Compare
Member
Author
|
I fail to understand why we have this non-flaky test failure, which I can reproduce in this branch but not in master: |
szuecs
commented
Apr 10, 2026
| ) | ||
|
|
||
| go 1.25.8 | ||
| go 1.26.1 |
Member
Author
There was a problem hiding this comment.
this create the test failure
% go test ./filters/fadein -run '^TestPostProcessor$/^invalid_endpoint_address$' -count 1 -v
=== RUN TestPostProcessor
=== RUN TestPostProcessor/invalid_endpoint_address
fadein_test.go:189: parse "http://::": invalid port "::" after host
--- FAIL: TestPostProcessor (0.00s)
--- FAIL: TestPostProcessor/invalid_endpoint_address (0.00s)
FAIL
issue introduced by Go version update failure was: fadein_test.go:189: parse "http://::": invalid port "::" after host Signed-off-by: Sandor Szücs <sandor.szuecs@zalando.de>
szuecs
commented
Apr 10, 2026
| t.Run("invalid endpoint address", func(t *testing.T) { | ||
| const routes = ` | ||
| * -> fadeIn("1m") -> <"http://::"> | ||
| * -> fadeIn("1m") -> <"http:/::"> |
Member
Author
There was a problem hiding this comment.
hack to fail differently, because of Go update to 1.26.1
Member
Author
|
👍 |
1 similar comment
Member
|
👍 |
This was referenced Apr 11, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Both depend only in tests/examples on docker/docker , so CVE is not a vulnerability in skipper binary.
testcontainers-go was fixed testcontainers/testcontainers-go#3591
eopa we are working on a fix open-policy-agent/eopa#370