mirror of
https://github.com/RayLabsHQ/gitea-mirror.git
synced 2026-08-18 16:01:05 +00:00
b33e7d5596
- Build git-lfs with Go 1.25.12 (stdlib CVEs fixed in 1.25.10) and pull golang.org/x/net past the fix for CVE-2026-39821; x/net 0.54.0 was flagged critical in the image scan. - Cap SARIF relatedLocations at 100 per result before upload. GitHub rejects SARIF with >1000 related locations per result, and Docker Scout exceeds that for common OS packages, so every upload since May had failed silently (continue-on-error) and the Security tab was frozen on a stale scan. With uploads flowing again, already-fixed alerts (samlify, libgnutls via the existing apt-get upgrade) close on the next scan.