build: update dependencies and base images to fix CVEs#71
Merged
tembleking merged 3 commits intomainfrom Mar 9, 2026
Merged
Conversation
Addresses 70 vulnerabilities (65 base image + 5 Go binary) found by Trivy in ghcr.io/sysdiglabs/sysdig-mcp-server:latest. Base image (RHEL 9.7) CVEs addressed by nixpkgs bump: - curl-minimal: CVE-2025-14017, CVE-2024-11053, CVE-2024-7264, CVE-2024-9681 - glib2: CVE-2025-14087, CVE-2025-14512, CVE-2026-1484, CVE-2026-1489, CVE-2023-32636, CVE-2025-3360, CVE-2025-7039, CVE-2026-0988, CVE-2026-1485 - glibc: CVE-2026-0915, CVE-2025-15281, CVE-2026-0861 - gnupg2: CVE-2025-68972, CVE-2022-3219, CVE-2025-30258, CVE-2026-24883 - coreutils-single: CVE-2025-5278 Go binary CVEs addressed by dependency updates: - mcp-go v0.44.1 → v0.45.0 - golang.org/x/sync v0.19.0 → v0.20.0 - golang.org/x/sys v0.41.0 → v0.42.0
Contributor
There was a problem hiding this comment.
Pull request overview
This PR addresses 70 CVEs found by Trivy in ghcr.io/sysdiglabs/sysdig-mcp-server:latest, updating both Go binary dependencies and the Nix base image environment.
Changes:
- Updated Go dependencies:
mcp-gov0.44.1 → v0.45.0,golang.org/x/syncv0.19.0 → v0.20.0,golang.org/x/sysv0.41.0 → v0.42.0 - Bumped nixpkgs in
flake.lockto a newer revision that resolves base image CVEs incurl-minimal,glib2,glibc,gnupg2, andcoreutils-single - Incremented the package version to 1.0.4 and updated the Nix vendor hash
Reviewed changes
Copilot reviewed 2 out of 4 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
go.mod |
Updated Go dependency versions for mcp-go, golang.org/x/sync, golang.org/x/sys; normalized go directive from 1.26.0 to 1.26 |
go.sum |
Updated checksums for the three upgraded Go dependencies |
package.nix |
Bumped version to 1.0.4 and updated vendorHash to match new Go dependencies |
flake.lock |
Updated pinned nixpkgs revision and hash to get patched base image packages |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
alecron
approved these changes
Mar 9, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps Go toolchain and dependencies to pick up available security fixes.
The nixpkgs update brings Go 1.26.1 which resolves 5 stdlib CVEs in the compiled binary:
url.Parseinsufficient host/authority validationGo dependency updates:
mcp-gov0.44.1 → v0.45.0golang.org/x/syncv0.19.0 → v0.20.0golang.org/x/sysv0.41.0 → v0.42.0The base image (RHEL 9.7) still carries 65 CVEs in "affected" status with no fixed version available upstream. Those remain unresolved by this change.