[dliub]

Container vulnerability remediation — cumulative draft (base 2.3.x)

Automated daily cumulative container-vulnerability remediation for hasura/hydra.
Requested by @tomhasura.

Scope summary (cumulative): ddn-oauth image gcr.io/hasura-ee/hydra:v2.3.2-alpine3.23.6, ecosystems Docker base-image (Go builder) + Go modules (lang-pkgs). Fixes in this branch:

• Dockerfile-hasura-alpine builder golang:1.26.8-bookworm → golang:1.26.9-bookworm (Go stdlib).
• go.mod / go.sum golang.org/x/net v0.58.0 → v0.60.0 (Go module).

Run: nightly-2026-10-10.209 (2026-10-10)

Scope: ddn-oauth image gcr.io/hasura-ee/hydra:v2.3.2-alpine3.23.6
sha256:d5e1a8fafd513de0ea17a41ba7ccb52afb71ec24a0377fcc3de10c411348d6a2

• New finding (Go module): golang.org/x/net in usr/bin/hydra — installed v0.58.0, fixed in v0.60.0 (HIGH).

  • CVE-2026-78669 — https://avd.aquasec.com/nvd/cve-2026-78669

• Source lever / fix: go.mod / go.sum — golang.org/x/net v0.58.0 → v0.60.0
  (go get golang.org/x/net@v0.60.0 + go mod tidy; no vendor dir, no replace
  directive pins x/net on 2.3.x). x/net v0.60.0 requires go 1.26.0, so the
  module go directive was raised 1.25.0 → 1.26.0 (the prior toolchain go1.25.14
  line was dropped by the tooling). This is satisfied at build time by the
  golang:1.26.9-bookworm hardened builder (which runs GOTOOLCHAIN=local).

  • Validation: native go build -trimpath -tags sqlite,sqlite_omit_load_extension
    under GOTOOLCHAIN=go1.26.9 succeeded (exit 0); go vet exit 0;
    go version -m on the resulting binary reports go1.26.9 and
    golang.org/x/net v0.60.0. Transitive golang.org/x/{crypto,mod,sync,sys,text}
    minimums required by x/net v0.60.0 were upgraded by MVS (none weakened).

• stdlib (carried, tonight also attributed CVE-2026-78669): Go stdlib in
  usr/bin/hydra — installed v1.26.8, fixed in 1.26.9, 1.27.2 (HIGH). Tonight's
  evidence attributes CVE-2026-78667, CVE-2026-78669, CVE-2026-97031 to stdlib.
  All three are remediated by the already-applied golang:1.26.9-bookworm builder bump
  below (no additional change needed for the stdlib instance of CVE-2026-78669).

Run: nightly-2026-10-09.208 (2026-10-09)

Scope: ddn-oauth image gcr.io/hasura-ee/hydra:v2.3.2-alpine3.23.6
sha256:d5e1a8fafd513de0ea17a41ba7ccb52afb71ec24a0377fcc3de10c411348d6a2

• Finding: Go stdlib in usr/bin/hydra — installed v1.26.8, fixed in 1.26.9, 1.27.2 (HIGH).
  • CVE-2026-78667 — https://avd.aquasec.com/nvd/cve-2026-78667
  • CVE-2026-97031 — https://avd.aquasec.com/nvd/cve-2026-97031
• Source lever / fix: Dockerfile-hasura-alpine builder stage
  golang:1.26.8-bookworm → golang:1.26.9-bookworm (same-minor patch).
  The build sets ENV GOTOOLCHAIN=local, so the builder image Go toolchain is what
  stamps the shipped usr/bin/hydra stdlib — this is the correct source-controlled
  lever. Pinned to the current multi-arch index digest
  sha256:d9c68c2c51161e12fd77e4c6320687c9cd86e1af1e3ad6e6cd63ff970641453c.

Not changed (with rationale):

• CI workflows (.github/workflows/ci.yaml Go 1.22, cve-scan.yaml →
  .docker/Dockerfile-local-build): used for tests/scan only; they do not build the
  shipped hardened image binary, so they are not the lever for these findings.
• Base images (alpine:3.23.6) and non-stdlib / non-x/net findings: out of scope
  for today's evidence.

Explicitly excluded (user-decided): CVE-2026-33504 and CVE-2026-32286 are a
user-decided false-positive / exception (OpenVEX merged as #8 / #9). Not acted on.
Upstream master is out of scope.

Cross-base follow-up (NOT included here — reported, no second PR)

Line 1.4.x builds oauth image gcr.io/hasura-ee/hydra:v1.4.16-alpine3.23.6
(sha256:6783a11748d9a3d27c842b59266aff92e0db5951c431add40703f2e0d72f7328) via
Dockerfile-alpine. Tonight's evidence reports two HIGH findings on that image's
usr/bin/hydra:

• Go stdlib v1.26.8 → fixed 1.26.9 / 1.27.2 (CVE-2026-78667, CVE-2026-78669,
  CVE-2026-97031). Lever: Dockerfile-alpine builder pin
  golang:1.26.8-bookworm@sha256:a688600ca24f8a4d3ca77f95b0dd40704a9fc787c826660eb7ba0b641b8b175d
  → golang:1.26.9-bookworm@sha256:d9c68c2c51161e12fd77e4c6320687c9cd86e1af1e3ad6e6cd63ff970641453c.
• golang.org/x/net v0.57.0 → fixed v0.60.0 (CVE-2026-78669). Note the 1.4.x
go.mod carries replace golang.org/x/net => golang.org/x/net v0.57.0, so the fix
  there is to bump that replace pin to v0.60.0 (plus go mod tidy), not a plain
  go get.

Per policy the 1.4.x work is deferred pending @tomhasura and intentionally not
opened as a second PR; it is recorded here as a cross-base follow-up only.

---

Draft opened by the automated remediation worker. Do not merge/approve/mark-ready
automatically.