From 065c9216afc74774433d0ade9ec1add7ac22ab57 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Wed, 23 Sep 2026 11:59:52 +0000 Subject: [PATCH 1/3] Update ghcr.io/wavelog/wavelog Docker tag to v3.2.3 --- apps/wavelog/3.1.0/docker-compose.yml | 2 +- apps/wavelog/3.2.0/docker-compose.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/apps/wavelog/3.1.0/docker-compose.yml b/apps/wavelog/3.1.0/docker-compose.yml index a9bb43372..06f2be173 100644 --- a/apps/wavelog/3.1.0/docker-compose.yml +++ b/apps/wavelog/3.1.0/docker-compose.yml @@ -1,7 +1,7 @@ services: wavelog: container_name: ${CONTAINER_NAME} - image: ghcr.io/wavelog/wavelog:3.2.2 + image: ghcr.io/wavelog/wavelog:3.2.3 environment: - CI_ENV=docker - TZ=${TZ:-Asia/Shanghai} diff --git a/apps/wavelog/3.2.0/docker-compose.yml b/apps/wavelog/3.2.0/docker-compose.yml index a9bb43372..06f2be173 100644 --- a/apps/wavelog/3.2.0/docker-compose.yml +++ b/apps/wavelog/3.2.0/docker-compose.yml @@ -1,7 +1,7 @@ services: wavelog: container_name: ${CONTAINER_NAME} - image: ghcr.io/wavelog/wavelog:3.2.2 + image: ghcr.io/wavelog/wavelog:3.2.3 environment: - CI_ENV=docker - TZ=${TZ:-Asia/Shanghai} From c27a4f6c1e60e3d7442c1e83f0368250360ae1e7 Mon Sep 17 00:00:00 2001 From: okxlin <61420215+okxlin@users.noreply.github.com> Date: Sat, 10 Oct 2026 13:18:30 +0800 Subject: [PATCH 2/3] fix(wavelog): align image update package version --- apps/wavelog/3.1.0/docker-compose.yml | 2 +- apps/wavelog/{3.2.0 => 3.2.3}/.env.sample | 0 apps/wavelog/{3.2.0 => 3.2.3}/data.yml | 0 apps/wavelog/{3.2.0 => 3.2.3}/docker-compose.yml | 0 apps/wavelog/{3.2.0 => 3.2.3}/scripts/init.sh | 0 apps/wavelog/{3.2.0 => 3.2.3}/scripts/uninstall.sh | 0 apps/wavelog/{3.2.0 => 3.2.3}/scripts/upgrade.sh | 0 apps/wavelog/README.md | 6 ++++-- 8 files changed, 5 insertions(+), 3 deletions(-) rename apps/wavelog/{3.2.0 => 3.2.3}/.env.sample (100%) rename apps/wavelog/{3.2.0 => 3.2.3}/data.yml (100%) rename apps/wavelog/{3.2.0 => 3.2.3}/docker-compose.yml (100%) rename apps/wavelog/{3.2.0 => 3.2.3}/scripts/init.sh (100%) rename apps/wavelog/{3.2.0 => 3.2.3}/scripts/uninstall.sh (100%) rename apps/wavelog/{3.2.0 => 3.2.3}/scripts/upgrade.sh (100%) diff --git a/apps/wavelog/3.1.0/docker-compose.yml b/apps/wavelog/3.1.0/docker-compose.yml index 06f2be173..a9bb43372 100644 --- a/apps/wavelog/3.1.0/docker-compose.yml +++ b/apps/wavelog/3.1.0/docker-compose.yml @@ -1,7 +1,7 @@ services: wavelog: container_name: ${CONTAINER_NAME} - image: ghcr.io/wavelog/wavelog:3.2.3 + image: ghcr.io/wavelog/wavelog:3.2.2 environment: - CI_ENV=docker - TZ=${TZ:-Asia/Shanghai} diff --git a/apps/wavelog/3.2.0/.env.sample b/apps/wavelog/3.2.3/.env.sample similarity index 100% rename from apps/wavelog/3.2.0/.env.sample rename to apps/wavelog/3.2.3/.env.sample diff --git a/apps/wavelog/3.2.0/data.yml b/apps/wavelog/3.2.3/data.yml similarity index 100% rename from apps/wavelog/3.2.0/data.yml rename to apps/wavelog/3.2.3/data.yml diff --git a/apps/wavelog/3.2.0/docker-compose.yml b/apps/wavelog/3.2.3/docker-compose.yml similarity index 100% rename from apps/wavelog/3.2.0/docker-compose.yml rename to apps/wavelog/3.2.3/docker-compose.yml diff --git a/apps/wavelog/3.2.0/scripts/init.sh b/apps/wavelog/3.2.3/scripts/init.sh similarity index 100% rename from apps/wavelog/3.2.0/scripts/init.sh rename to apps/wavelog/3.2.3/scripts/init.sh diff --git a/apps/wavelog/3.2.0/scripts/uninstall.sh b/apps/wavelog/3.2.3/scripts/uninstall.sh similarity index 100% rename from apps/wavelog/3.2.0/scripts/uninstall.sh rename to apps/wavelog/3.2.3/scripts/uninstall.sh diff --git a/apps/wavelog/3.2.0/scripts/upgrade.sh b/apps/wavelog/3.2.3/scripts/upgrade.sh similarity index 100% rename from apps/wavelog/3.2.0/scripts/upgrade.sh rename to apps/wavelog/3.2.3/scripts/upgrade.sh diff --git a/apps/wavelog/README.md b/apps/wavelog/README.md index e482d6ed5..f112fc1c2 100644 --- a/apps/wavelog/README.md +++ b/apps/wavelog/README.md @@ -47,8 +47,10 @@ - 如需对外开放访问，请同步检查防火墙、安全组和反向代理配置。 ## 安全提示 -- 当前应用使用上游官方镜像 `ghcr.io/wavelog/wavelog`。官方镜像功能完整，但常见镜像扫描结果可能包含较多 High / Critical 级别漏洞条目，请结合自身暴露面评估风险。 -- 建议仅在可信网络中部署，及时跟进上游镜像更新，并通过反向代理、访问控制和最小暴露原则降低风险。 +- 2026-10-10 对 `ghcr.io/wavelog/wavelog:3.2.3`（digest `sha256:600c3205ca2b5d7976beedabd023cb91e3f3dfdf45b5d58708dab75ade3b94e3`）的 Trivy 扫描报告了 2 个 Critical 和 223 个 High 漏洞；镜像更新后应重新评估扫描结果。 +- Critical 项 [`CVE-2026-6653`](https://security-tracker.debian.org/tracker/CVE-2026-6653) 涉及镜像中的 `libxml2`；扫描时 Debian 13 尚无修复版本。Wavelog 会解析外部 XML 数据；在上游发布修复镜像前，请限制不可信 XML 输入，并只在可信网络中部署。 +- Critical 项 [`CVE-2026-43185`](https://security-tracker.debian.org/tracker/CVE-2026-43185) 来自 `linux-libc-dev` 头文件包，描述的是 Linux `ksmbd` 内核漏洞。镜像中未发现内核镜像或 `ksmbd` 模块，容器也不提供宿主机内核；此扫描结果不代表宿主机已修复，请单独维护部署主机的内核。 +- 及时跟进上游镜像更新，并通过反向代理、访问控制和最小暴露原则降低风险。 ## 参考资料 - 官网: From 07b02d1d3f8d7fdcc8558d774bd0ce31e498bf97 Mon Sep 17 00:00:00 2001 From: okxlin <61420215+okxlin@users.noreply.github.com> Date: Fri, 16 Oct 2026 06:16:10 +0800 Subject: [PATCH 3/3] fix(wavelog): remove stale scan findings from update PR --- apps/wavelog/README.md | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/apps/wavelog/README.md b/apps/wavelog/README.md index f112fc1c2..e482d6ed5 100644 --- a/apps/wavelog/README.md +++ b/apps/wavelog/README.md @@ -47,10 +47,8 @@ - 如需对外开放访问，请同步检查防火墙、安全组和反向代理配置。 ## 安全提示 -- 2026-10-10 对 `ghcr.io/wavelog/wavelog:3.2.3`（digest `sha256:600c3205ca2b5d7976beedabd023cb91e3f3dfdf45b5d58708dab75ade3b94e3`）的 Trivy 扫描报告了 2 个 Critical 和 223 个 High 漏洞；镜像更新后应重新评估扫描结果。 -- Critical 项 [`CVE-2026-6653`](https://security-tracker.debian.org/tracker/CVE-2026-6653) 涉及镜像中的 `libxml2`；扫描时 Debian 13 尚无修复版本。Wavelog 会解析外部 XML 数据；在上游发布修复镜像前，请限制不可信 XML 输入，并只在可信网络中部署。 -- Critical 项 [`CVE-2026-43185`](https://security-tracker.debian.org/tracker/CVE-2026-43185) 来自 `linux-libc-dev` 头文件包，描述的是 Linux `ksmbd` 内核漏洞。镜像中未发现内核镜像或 `ksmbd` 模块，容器也不提供宿主机内核；此扫描结果不代表宿主机已修复，请单独维护部署主机的内核。 -- 及时跟进上游镜像更新，并通过反向代理、访问控制和最小暴露原则降低风险。 +- 当前应用使用上游官方镜像 `ghcr.io/wavelog/wavelog`。官方镜像功能完整，但常见镜像扫描结果可能包含较多 High / Critical 级别漏洞条目，请结合自身暴露面评估风险。 +- 建议仅在可信网络中部署，及时跟进上游镜像更新，并通过反向代理、访问控制和最小暴露原则降低风险。 ## 参考资料 - 官网: