From bed232bdf4d157defcdbe38297be81a4ad769287 Mon Sep 17 00:00:00 2001 From: "SUSE Observability AI (POC)" Date: Wed, 9 Sep 2026 10:44:56 +0000 Subject: [PATCH] Refresh BCI minimal base to 15.7-26.49 for libbz2-1 libbz2-1 1.0.8-150400.1.122 in the pinned base bci-minimal:15.7-26.34 is reported vulnerable to CVE-2026-42250 (MEDIUM, Grype-only; Trivy reports zero for the same image). The fix, 1.0.8-150400.3.4.1, first ships in bci-minimal:15.7-26.49, which is also the current floating 15.7 tag. The advisory is new rather than a regression: the base tag digest has not moved (sha256:22a3f23959ee) and the same image content scanned clean on 2026-08-27, so rebuilding the current pin cannot clear the row and there is no newer published contrib-stackpacks tag to promote instead. The apply-oci-labels base-name input is bumped alongside the FROM line so the published image labels keep naming the base it was actually built from. Validated locally on amd64 and arm64: both carry libbz2-1 1.0.8-150400.3.4.1, with zero Grype matches, zero Trivy vulnerabilities at all severities and zero Trivy secret findings. Builds from the old pin reproduce the CVE-2026-42250 row on both architectures as a negative control. Refs: https://github.com/StackVista/cve-reporter/issues/91 --- .github/workflows/stackpacks-ci.yml | 2 +- docker/Dockerfile | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/stackpacks-ci.yml b/.github/workflows/stackpacks-ci.yml index 9d8ab31..413e27c 100644 --- a/.github/workflows/stackpacks-ci.yml +++ b/.github/workflows/stackpacks-ci.yml @@ -287,7 +287,7 @@ jobs: description: Community stackpacks distribution bundle component: contrib-stackpacks dockerfile: docker/Dockerfile - base-name: registry.suse.com/bci/bci-minimal:15.7-26.34 + base-name: registry.suse.com/bci/bci-minimal:15.7-26.49 - name: Push single-arch image (amd64) uses: StackVista/image-pipeline/.github/actions/push-single-arch@f7e766e074b516bb754891a240e6ab2df1e60e4c diff --git a/docker/Dockerfile b/docker/Dockerfile index 0586cf0..5d2aea5 100644 --- a/docker/Dockerfile +++ b/docker/Dockerfile @@ -1,4 +1,4 @@ -FROM registry.suse.com/bci/bci-minimal:15.7-26.34 +FROM registry.suse.com/bci/bci-minimal:15.7-26.49 COPY rootfs/stackpacks /stackpacks