windmill

mirror of https://github.com/windmill-labs/windmill.git synced 2026-08-18 16:02:10 +00:00

Files

T

History

Ruben Fiszel 5626768471 fix(cli-image): patch fixable CRITICAL CVEs in windmill-cli image (GIT-922) (#10135 )

The published ghcr.io/windmill-labs/windmill-cli image shipped two fixable
CRITICAL findings:

- openssl (libssl3t64, openssl-provider-legacy): stale in the oven/bun:slim
  base image (CVE-2026-34182). Fixed by running apt-get upgrade so the image
  picks up the patched Debian packages.
- vitest 2.1.9 (CVE-2026-47429 / GHSA-5xrq-8626-4rwp): a dev-only
  devDependency reference in esrap's cached package.json living in bun's
  package download cache. The cache is unused at runtime, so it is removed
  after install.

Validated by building the image and scanning with Trivy: openssl now reports
3.5.6-1~deb13u2 (fixed) and vitest is entirely absent. wmill still runs. The
only remaining CRITICALs are perl-base CVEs with no upstream fix available.

Fixes GIT-922

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-07-15 15:21:16 +02:00

RHEL8

Refresh slim image runtime packages (#9396 )

2026-06-02 08:16:11 +00:00

RHEL9

Refresh slim image runtime packages (#9396 )

2026-06-02 08:16:11 +00:00

dev.nu

feat: make nsjail available in all standard images (CE) (#7793 )

2026-02-04 18:48:16 +00:00

DockerfileCaddyL4

fix(self-host): resolve caddy-l4 "unrecognized global option: layer4" error (#10106 )