[container-image-scan] Container findings for ghcr.io/github/gh-aw-node

[github-actions]

Summary

Image: ghcr.io/github/gh-aw-node@sha256:a8082161d7dceda14b68f32eb39d0eaa96b825d07f5895b096afab9d9e0c7748

Grype found 1 High vulnerability, 5 Medium, and Grant found license policy violations (BlueOak-1.0.0 and GPL packages).

Vulnerabilities

High severity (1)

CVE / ID	Package	Installed	Fix
GHSA-mh99-v99m-4gvg	brace-expansion	5.0.7	5.0.8

Medium severity (5)

CVE / ID	Package	Installed	Fix
[CVE-2025-60876]((nvd.nist.gov/redacted)	busybox, busybox-binsh, ssl_client	1.37.0-r31	—
[CVE-2026-58055]((nvd.nist.gov/redacted)	nghttp2-libs	1.69.0-r0	—
GHSA-r292-9mhp-454m	tar	7.5.19	7.5.21

License Violations

License policy violations (sample)

Package	Licenses
chownr, glob	BlueOak-1.0.0
git-init-template	GPL-2.0-only
spdx-exceptions	CC-BY-3.0

Remediation

• Update brace-expansion to ≥5.0.8 and tar to ≥7.5.21.
• Upgrade Alpine base image.
• Review BlueOak-1.0.0 and GPL-2.0 packages; add to allow-list or remove.

Generated by 🛡️ Daily Container Image Security Scan · sonnet46 · 161.6 AIC · ⌖ 6.65 AIC · ⊞ 4.5K · ◷

[github-actions]

🍪 Issue Monster selected this for Copilot

I’ve identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

🍪 Om nom nom by Issue Monster · gpt54 · 2.24 AIC · ⌖ 8.74 AIC · ⊞ 8.9K · ◷