Update serena-mcp-server container image to remediate critical CVEs - #50245
Merged
Conversation
…al CVEs Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Copilot
AI
changed the title
[WIP] Fix container image vulnerabilities for ghcr.io/github/serena-mcp-server
Update serena-mcp-server container image to remediate critical CVEs
Aug 4, 2026
pelikhan
marked this pull request as ready for review
August 4, 2026 12:38
Contributor
There was a problem hiding this comment.
Pull request overview
Updates the shared Serena MCP container pin and propagates it through generated workflows and test fixtures.
Changes:
- Bumps Serena to
sha-891c160. - Synchronizes container pin data and golden fixtures.
- Recompiles all Serena-consuming workflows.
Show a summary per file
| File | Description |
|---|---|
.github/aw/actions-lock.json |
Updates Serena digest metadata. |
.github/workflows/shared/mcp/serena.md |
Changes the shared Serena image. |
.github/workflows/archie.lock.yml |
Regenerates the Serena pin. |
.github/workflows/cloclo.lock.yml |
Regenerates the Serena pin. |
.github/workflows/daily-compiler-quality.lock.yml |
Regenerates the Serena pin. |
.github/workflows/daily-file-diet.lock.yml |
Regenerates the Serena pin. |
.github/workflows/daily-function-namer.lock.yml |
Regenerates the Serena pin. |
.github/workflows/daily-mcp-concurrency-analysis.lock.yml |
Regenerates the Serena pin. |
.github/workflows/daily-testify-uber-super-expert.lock.yml |
Regenerates the Serena pin. |
.github/workflows/developer-docs-consolidator.lock.yml |
Regenerates the Serena pin. |
.github/workflows/duplicate-code-detector.lock.yml |
Regenerates the Serena pin. |
.github/workflows/glossary-maintainer.lock.yml |
Regenerates the Serena pin. |
.github/workflows/go-fan.lock.yml |
Regenerates the Serena pin. |
.github/workflows/linter-miner.lock.yml |
Regenerates the Serena pin. |
.github/workflows/mcp-inspector.lock.yml |
Regenerates the Serena pin. |
.github/workflows/semantic-function-refactor.lock.yml |
Regenerates the Serena pin. |
.github/workflows/sergo.lock.yml |
Regenerates the Serena pin. |
.github/workflows/smoke-codex.lock.yml |
Regenerates the Serena pin. |
.github/workflows/smoke-copilot.lock.yml |
Regenerates the Serena pin. |
.github/workflows/smoke-copilot-aoai-apikey.lock.yml |
Regenerates the Serena pin. |
.github/workflows/smoke-copilot-aoai-entra.lock.yml |
Regenerates the Serena pin. |
.github/workflows/smoke-copilot-arm.lock.yml |
Regenerates the Serena pin for ARM. |
.github/workflows/spec-extractor.lock.yml |
Regenerates the Serena pin. |
.github/workflows/spec-librarian.lock.yml |
Regenerates the Serena pin. |
.github/workflows/terminal-stylist.lock.yml |
Regenerates the Serena pin. |
.github/workflows/typist.lock.yml |
Regenerates the Serena pin. |
pkg/actionpins/data/action_pins.json |
Synchronizes embedded pin data. |
pkg/workflow/data/action_pins.json |
Synchronizes compiler pin data. |
pkg/workflow/testdata/TestWasmGolden_CompileFixtures/smoke-copilot.golden |
Updates compiled golden output. |
pkg/workflow/testdata/wasm_golden/WasmBinary/smoke-copilot.golden |
Updates WASM golden output. |
pkg/workflow/testdata/wasm_golden/fixtures/shared/mcp/serena.md |
Updates the WASM Serena fixture. |
Review details
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 31/31 changed files
- Comments generated: 2
- Review effort level: Balanced
| mcp-servers: | ||
| serena: | ||
| container: "ghcr.io/github/serena-mcp-server:sha-2491b68" | ||
| container: "ghcr.io/github/serena-mcp-server:sha-891c160" |
| run: bash "${RUNNER_TEMP}/gh-aw/actions/restore_inline_skills.sh" | ||
| - name: Download container images | ||
| run: bash "${RUNNER_TEMP}/gh-aw/actions/download_docker_images.sh" ghcr.io/github/gh-aw-firewall/agent:0.27.43@sha256:04e2d1987a565000a8f114b89d806ae7a3864dd4f944be65275b28c93d8690e6 ghcr.io/github/gh-aw-firewall/api-proxy:0.27.43@sha256:d85f57975af5ea23af4996e41ed73fbc8f5b4a47402472bfe82e508f352cb0c1 ghcr.io/github/gh-aw-firewall/squid:0.27.43@sha256:26be5e0b8c8f4c41c8a59126b29bb5d80b07253597472ded2a16bdd75abcbf9d ghcr.io/github/gh-aw-mcpg:v0.4.7@sha256:7545220a9aca134b71e51193ee0eaf4c50756ebf8fbd25a63ae7556e62815c00 ghcr.io/github/gh-aw-node@sha256:0d9f1fb5fd6610c0ac1f5194a38e45a8a1e81f8a390d5142d8e4e6f26a4b3196 ghcr.io/github/github-mcp-server:v1.8.0@sha256:d5a18c04b92714c309eb46a2305087e91a4dbd80420f6e462656699f95093520 ghcr.io/github/serena-mcp-server:sha-2491b68@sha256:2fc3fab11db8baca5b4fa760ec52f1010425c97edc8bf4c6437f0cdabd17fcb7 | ||
| run: bash "${RUNNER_TEMP}/gh-aw/actions/download_docker_images.sh" ghcr.io/github/gh-aw-firewall/agent:0.27.43@sha256:04e2d1987a565000a8f114b89d806ae7a3864dd4f944be65275b28c93d8690e6 ghcr.io/github/gh-aw-firewall/api-proxy:0.27.43@sha256:d85f57975af5ea23af4996e41ed73fbc8f5b4a47402472bfe82e508f352cb0c1 ghcr.io/github/gh-aw-firewall/squid:0.27.43@sha256:26be5e0b8c8f4c41c8a59126b29bb5d80b07253597472ded2a16bdd75abcbf9d ghcr.io/github/gh-aw-mcpg:v0.4.7@sha256:7545220a9aca134b71e51193ee0eaf4c50756ebf8fbd25a63ae7556e62815c00 ghcr.io/github/gh-aw-node@sha256:0d9f1fb5fd6610c0ac1f5194a38e45a8a1e81f8a390d5142d8e4e6f26a4b3196 ghcr.io/github/github-mcp-server:v1.8.0@sha256:d5a18c04b92714c309eb46a2305087e91a4dbd80420f6e462656699f95093520 ghcr.io/github/serena-mcp-server:sha-891c160@sha256:bf343399e3725c45528f531a230f3a04521d4cdef29f9a5af6282ff0d3c393c5 |
6 tasks
Contributor
|
🎉 This pull request is included in a new release. Release: |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A container scan flagged
ghcr.io/github/serena-mcp-server:sha-2491b68with 57 critical and 298 high severity CVEs, mostly in its Debian bookworm base and Node.js runtime.Changes
ghcr.io/github/serena-mcp-server:sha-2491b68→sha-891c160(digestsha256:bf343399e3725c45528f531a230f3a04521d4cdef29f9a5af6282ff0d3c393c5) in.github/workflows/shared/mcp/serena.md, the shared import used by all workflows that enable Serena..github/aw/actions-lock.jsonand regenerated the derivedpkg/actionpins/data/action_pins.json/pkg/workflow/data/action_pins.jsonviamake sync-action-pins..lock.ymlfiles that importshared/mcp/serena.mdso the new pinned digest is baked into theirdownload_docker_images.shcalls and MCP config.