Repository navigation
microvm-rootfs: bump 5 Alpine pins with upstream security fixes (expat, nghttp2, pcre2, openssl) - #868
Closed
bryan-minimal wants to merge 1 commit into
Closed
microvm-rootfs: bump 5 Alpine pins with upstream security fixes (expat, nghttp2, pcre2, openssl)#868bryan-minimal wants to merge 1 commit into
bryan-minimal wants to merge 1 commit into
Conversation
libexpat 2.8.5-r0 (CVE-2026-93990), nghttp2-libs 1.70.0-r0 (CVE-2026-58055), pcre2 10.49-r0 (CVE-2026-103111), libssl3/libcrypto3 3.5.9-r0. All current in v3.24 main; deps unchanged (musl, plus the libssl3=libcrypto3 pair). Mirrored to gs://minimal-staging-archives/alpine/v3.24/main/{aarch64,x86_64}. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
📝 Walkthrough
Merge Risk: ⚪ Minimal · up to
|
| Check name | Status | Explanation |
|---|---|---|
| Description Check |  |
Check skipped - CodeRabbit’s high-level summary is enabled. |
| Title check | |
The title clearly and concisely summarizes the main change: five Alpine package pins were updated for upstream security fixes, including the affected packages. |
| Docstring Coverage | |
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0… |
| Linked Issues check | |
Check skipped because no linked issues were found for this pull request. |
| Out of Scope Changes check | |
Check skipped because no linked issues were found for this pull request. |
✨ Finishing Touches
-
🧪 Generate unit tests (beta)
-
- Commit to this branch
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Comment @coderabbitai help to get the list of available commands.
Member
|
Closing as superseded by #933. It makes the same nghttp2, pcre2 and openssl pin changes and takes the newer libexpat 2.9.0 (this PR has 2.8.5). The two edit the same lines, so only one can land. The zlib CVE noted here as unfixed is still open; Alpine has no newer zlib for v3.24 yet. Generated by Claude Code |
evanspearman
pushed a commit
to evanspearman/pkgs
that referenced
this pull request
Oct 20, 2026
…ssl) (gominimal#933) Alpine v3.24/main ships fixed builds; per Alpine secdb: - libexpat 2.8.4-r0 -> 2.9.0-r0 CVE-2026-93990 (2.8.5-r0), CVE-2026-102633, CVE-2026-77214 (2.9.0-r0) - nghttp2-libs 1.69.0-r0 -> 1.70.0-r0 CVE-2026-58055 - pcre2 10.48-r0 -> 10.49-r0 CVE-2026-103111 - libcrypto3 + libssl3 3.5.8-r0 -> 3.5.9-r0 (no secdb entry; keeps the base-layer override at the branch's current build, still above the 3.24.1 minirootfs's 3.5.7-r0) Dependencies unchanged (musl only; libssl3 -> libcrypto3=3.5.9-r0 moves with it). Every .apk verified against the v3.24 APKINDEX for both arches (size, C: control-segment SHA1, and .PKGINFO datahash), mirrored to gs://minimal-staging-archives, and round-tripped byte-identical. Found by pkgmgr's alpine-pins audit in the 2026-10-19 nightly. Supersedes gominimal#868 (same openssl/nghttp2/pcre2 hashes; expat goes further). Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The nightly
alpine-pinsandcomponentsaudits (2026-10-13) flagged pinned.apkfiles in microvm-rootfs that are missing upstream security fixes. Alpine v3.24/main already ships the fixed builds.Verification:
libssl3→libcrypto3=3.5.9-r0, which moves with it, so the closure is unchanged..apkwas downloaded over HTTPS from dl-cdn and sha256'd per arch, then mirrored togs://minimal-staging-archives/alpine/v3.24/main/{aarch64,x86_64}/(the layout the recipe reads).min package build --rebuild microvm-rootfsin a fresh session succeeded. build.sh reconciled the apk db to libcrypto3/libssl3 3.5.9-r0, andmin check --packages microvm-rootfspasses.Not fixed here:
zlib 1.3.2-r0(CVE-2026-85091, from the component audit). Alpine has no newer zlib in v3.24 yet; it will show up inalpine-pinsonce it does.The libssl3/libcrypto3 "SECURITY" flag in the same audit came from openssl's 1.1.1x secdb entries that the version comparator couldn't order (fixed in gominimal/pkgmgr-rs#961). Taking 3.5.9 here keeps the override at the branch's current build.
🤖 Generated with Claude Code
Summary by CodeRabbit