Skip to content

chore: upgrade curl to >=8.22.0-r0 to address 18 curl/libcurl CVEs - #1634

Closed
claude[bot] wants to merge 2 commits into
mainfrom
cursor/cve/curl
Closed

chore: upgrade curl to >=8.22.0-r0 to address 18 curl/libcurl CVEs#1634
claude[bot] wants to merge 2 commits into
mainfrom
cursor/cve/curl

Conversation

@claude

@claude claude Bot commented Sep 5, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Summary

Trivy reports curl and libcurl at 8.20.0-r0 in the runner image, which is affected by the batch of upstream curl security fixes released in 8.21.0/8.22.0. Alpine ships the fixes in 8.22.0-r0.

The runner stage already ran apk upgrade --no-cache, but that alone is not a guarantee: the RUN layer is served from the GitHub Actions buildx cache (cache-from: type=gha in .github/workflows/_build.yml), so an unchanged command can keep resolving to a stale package set. Adding an explicit minimum version turns the patched floor into a build-time requirement, so the image can never silently ship a vulnerable curl/libcurl again.

libcurl is not installed explicitly. Alpine's curl package depends on libcurl at the same version, so constraining curl pins both.

Advisories addressed

CVE Severity
CVE-2026-8286 HIGH
CVE-2026-8458 HIGH
CVE-2026-8924 MEDIUM
CVE-2026-8925 HIGH
CVE-2026-8926 MEDIUM
CVE-2026-8927 HIGH
CVE-2026-8932 MEDIUM
CVE-2026-9079 MEDIUM
CVE-2026-9080 MEDIUM
CVE-2026-9545 MEDIUM
CVE-2026-9546 MEDIUM
CVE-2026-9547 HIGH
CVE-2026-10536 MEDIUM
CVE-2026-11352 HIGH
CVE-2026-11564 MEDIUM
CVE-2026-11586 HIGH
CVE-2026-11856 MEDIUM
CVE-2026-12064 HIGH

Verification — please read before merging

This change has not been build-verified. Two things to be aware of:

  1. There is no Docker daemon and no access to the Alpine package index from the remediation environment, so curl>=8.22.0-r0 could not be resolved locally. The floor is taken from Trivy's FixedVersion, which comes from Alpine's own v3.23 security database, so the package should be present in the branch.
  2. PR Gate did not run on this PR. It does not appear to trigger automatically for bot-authored PRs in this repo (the same is true of the existing chore: upgrade fflate to 0.4.9 to address CVE-2026-45820 #1629 and chore: upgrade @humanfs/node to 0.16.8 to address GHSA-p498-v437-472g #1630). Please approve/kick the PR Gate workflow run, or build the image locally, before merging.

If the pinned version is not yet published for a platform, apk fails the build loudly rather than silently shipping a vulnerable package. That is the intended behaviour, but it does mean an unverified merge could break main's image build.

Note for reviewers

A sibling PR raises the util-linux floor on the same apk add line. The two will conflict textually; whichever merges second needs a trivial rebase.

Fixes SOU-2149
Fixes SOU-2150
Fixes SOU-2151
Fixes SOU-2152
Fixes SOU-2153
Fixes SOU-2154
Fixes SOU-2161
Fixes SOU-2162
Fixes SOU-2163
Fixes SOU-2164
Fixes SOU-2165
Fixes SOU-2166
Fixes SOU-2167
Fixes SOU-2168
Fixes SOU-2169
Fixes SOU-2170
Fixes SOU-2171
Fixes SOU-2172

🤖 Generated with Claude Code

claude Bot and others added 2 commits September 5, 2026 11:30
@claude @claude
chore: pin curl to >=8.22.0-r0 in the container image
105f4a7 
Trivy reports the runner image shipping curl/libcurl 8.20.0-r0, which is
affected by a large batch of upstream curl security fixes released in
8.21.0/8.22.0. The runner stage already runs `apk upgrade --no-cache`, but
that alone can resolve against a cached layer and silently keep the old
package. Adding an explicit minimum version makes the floor a build-time
requirement.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@claude @claude
chore: add CHANGELOG entry for #1634
c81779a 
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@github-actions

github-actions Bot commented Sep 5, 2026

Copy link
Copy Markdown
Contributor

@claude[bot] your pull request is missing a changelog!

@claude claude Bot mentioned this pull request Sep 5, 2026
Closed
@brendan-kellam

brendan-kellam commented Sep 9, 2026

Copy link
Copy Markdown
Contributor

Closing because Alpine 3.23 already publishes curl/libcurl 8.22.0-r0 for both supported architectures, and Alpine's security database lists all 18 CVEs in this PR as fixed in that version. The existing Dockerfile installs curl and runs apk upgrade --no-cache, so a fresh execution of that layer should obtain the patched packages without this version constraint.

The cache rationale also overstates the need for this change: the image build passes NEXT_PUBLIC_BUILD_COMMIT_SHA and sets it in the runner environment before the package-install step, which should invalidate that layer when the commit changes. Rebuilding the same commit can still reuse cached layers.

This closure does not mean previously published images are patched. The September 4 build inspected installed curl/libcurl 8.20.0-r0 on both architectures; a rebuilt image should be checked for the patched versions and rescanned before treating the associated findings as resolved.

Sources:

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@brendan-kellam