Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
64 changes: 34 additions & 30 deletions go.mod
Original file line number Diff line number Diff line change
Expand Up @@ -5,9 +5,9 @@ go 1.25.8
require (
github.com/DmitriyVTitov/size v1.5.0
github.com/Masterminds/semver/v3 v3.4.0
github.com/anchore/syft v1.32.0
github.com/anchore/syft v1.42.3
github.com/aquilax/truncate v1.0.0
github.com/armosec/armoapi-go v0.0.694
github.com/armosec/armoapi-go v0.0.719
github.com/armosec/utils-k8s-go v0.0.35
github.com/cenkalti/backoff v2.2.1+incompatible
github.com/cenkalti/backoff/v4 v4.3.0
Expand All @@ -24,7 +24,7 @@ require (
github.com/facette/natsort v0.0.0-20181210072756-2cd4dd1e2dcb
github.com/go-openapi/strfmt v0.23.0
github.com/google/cel-go v0.26.1
github.com/google/go-containerregistry v0.20.7
github.com/google/go-containerregistry v0.21.2
github.com/google/uuid v1.6.0
github.com/goradd/maps v1.3.0
github.com/grafana/pyroscope-go v1.2.2
Expand All @@ -34,8 +34,8 @@ require (
github.com/joncrlsn/dque v0.0.0-20241024143830-7723fd131a64
github.com/kubescape/backend v0.0.39
github.com/kubescape/go-logger v0.0.32
github.com/kubescape/k8s-interface v0.0.213
github.com/kubescape/storage v0.0.258
github.com/kubescape/k8s-interface v0.0.214
github.com/kubescape/storage v0.0.282
github.com/kubescape/workerpool v0.0.0-20250526074519-0e4a4e7f44cf
github.com/moby/sys/mountinfo v0.7.2
github.com/oleiade/lane/v2 v2.0.0
Expand All @@ -47,7 +47,7 @@ require (
github.com/prometheus/alertmanager v0.27.0
github.com/prometheus/client_golang v1.23.2
github.com/prometheus/procfs v0.20.1
github.com/sirupsen/logrus v1.9.4-0.20230606125235-dd1b4c2e81af
github.com/sirupsen/logrus v1.9.4
github.com/spf13/afero v1.15.0
github.com/spf13/viper v1.21.0
github.com/stretchr/testify v1.11.1
Expand All @@ -57,6 +57,7 @@ require (
go.opentelemetry.io/otel v1.43.0
go.opentelemetry.io/otel/exporters/prometheus v0.65.0
go.opentelemetry.io/otel/log v0.19.0
go.opentelemetry.io/otel/log/logtest v0.19.0
go.opentelemetry.io/otel/metric v1.43.0
go.opentelemetry.io/otel/sdk v1.43.0
go.opentelemetry.io/otel/sdk/metric v1.43.0
Expand All @@ -69,15 +70,14 @@ require (
google.golang.org/grpc v1.80.0
google.golang.org/protobuf v1.36.11
gopkg.in/mcuadros/go-syslog.v2 v2.3.0
gopkg.in/yaml.v3 v3.0.1
istio.io/pkg v0.0.0-20231221211216-7635388a563e
k8s.io/api v0.35.0
k8s.io/apimachinery v0.35.0
k8s.io/client-go v0.35.0
k8s.io/cri-api v0.35.0
k8s.io/kubectl v0.34.1
k8s.io/utils v0.0.0-20260319190234-28399d86e0b5
modernc.org/sqlite v1.38.2
modernc.org/sqlite v1.46.1
oras.land/oras-go/v2 v2.6.0
sigs.k8s.io/yaml v1.6.0
)
Expand Down Expand Up @@ -107,9 +107,9 @@ require (
github.com/Masterminds/goutils v1.1.1 // indirect
github.com/Masterminds/sprig/v3 v3.3.0 // indirect
github.com/Microsoft/go-winio v0.6.2 // indirect
github.com/Microsoft/hcsshim v0.13.0 // indirect
github.com/Microsoft/hcsshim v0.14.0-rc.1 // indirect
github.com/OneOfOne/xxhash v1.2.8 // indirect
github.com/ProtonMail/go-crypto v1.3.0 // indirect
github.com/ProtonMail/go-crypto v1.4.0 // indirect
github.com/STARRY-S/zip v0.2.3 // indirect
github.com/SergJa/jsonhash v0.0.0-20210531165746-fc45f346aa74 // indirect
github.com/acobaugh/osrelease v0.1.0 // indirect
Expand All @@ -129,7 +129,7 @@ require (
github.com/anchore/go-sync v0.0.0-20250714163430-add63db73ad1 // indirect
github.com/anchore/go-version v1.2.2-0.20210903204242-51efa5b487c4 // indirect
github.com/anchore/packageurl-go v0.1.1-0.20250220190351-d62adb6e1115 // indirect
github.com/anchore/stereoscope v0.1.9 // indirect
github.com/anchore/stereoscope v0.1.22 // indirect
github.com/andybalholm/brotli v1.2.0 // indirect
github.com/antlr4-go/antlr/v4 v4.13.0 // indirect
github.com/apparentlymart/go-textseg/v15 v15.0.0 // indirect
Expand Down Expand Up @@ -167,7 +167,7 @@ require (
github.com/blakesmith/ar v0.0.0-20190502131153-809d4375e1fb // indirect
github.com/blang/semver v3.5.1+incompatible // indirect
github.com/blang/semver/v4 v4.0.0 // indirect
github.com/bmatcuk/doublestar/v4 v4.9.1 // indirect
github.com/bmatcuk/doublestar/v4 v4.10.0 // indirect
github.com/bodgit/plumbing v1.3.0 // indirect
github.com/bodgit/sevenzip v1.6.1 // indirect
github.com/bodgit/windows v1.0.1 // indirect
Expand All @@ -182,17 +182,17 @@ require (
github.com/cloudflare/cbpfc v0.0.0-20240920015331-ff978e94500b // indirect
github.com/cloudflare/circl v1.6.3 // indirect
github.com/cncf/xds/go v0.0.0-20251210132809-ee656c7534f5 // indirect
github.com/containerd/cgroups/v3 v3.0.5 // indirect
github.com/containerd/cgroups/v3 v3.1.2 // indirect
github.com/containerd/containerd v1.7.32 // indirect
github.com/containerd/containerd/api v1.9.0 // indirect
github.com/containerd/containerd/api v1.10.0 // indirect
github.com/containerd/continuity v0.4.5 // indirect
github.com/containerd/errdefs v1.0.0 // indirect
github.com/containerd/errdefs/pkg v0.3.0 // indirect
github.com/containerd/fifo v1.1.0 // indirect
github.com/containerd/log v0.1.0 // indirect
github.com/containerd/nri v0.9.0 // indirect
github.com/containerd/platforms v0.2.1 // indirect
github.com/containerd/stargz-snapshotter/estargz v0.18.1 // indirect
github.com/containerd/nri v0.11.0 // indirect
github.com/containerd/platforms v1.0.0-rc.2 // indirect
github.com/containerd/stargz-snapshotter/estargz v0.18.2 // indirect
github.com/containerd/ttrpc v1.2.7 // indirect
github.com/containerd/typeurl/v2 v2.2.3 // indirect
github.com/containers/common v0.64.2 // indirect
Expand All @@ -202,16 +202,16 @@ require (
github.com/deitch/magic v0.0.0-20240306090643-c67ab88f10cb // indirect
github.com/diskfs/go-diskfs v1.7.0 // indirect
github.com/distribution/reference v0.6.0 // indirect
github.com/docker/cli v29.2.0+incompatible // indirect
github.com/docker/cli v29.3.0+incompatible // indirect
github.com/docker/distribution v2.8.3+incompatible // indirect
github.com/docker/docker v28.5.2+incompatible // indirect

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Check for Docker security advisories and patched versions

gh api graphql -f query='
{
  securityVulnerabilities(first: 15, ecosystem: GO, package: "github.com/docker/docker") {
    nodes {
      advisory {
        summary
        severity
        publishedAt
      }
      vulnerableVersionRange
      firstPatchedVersion {
        identifier
      }
    }
  }
}'

echo "---"
echo "Checking which direct dependencies pull in docker/docker:"
rg -n "github.com/docker/docker" go.mod

Repository: kubescape/node-agent

Length of output: 3625


🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== go.mod entries =="
rg -n "github.com/docker/docker" go.mod

echo
echo "== go mod why (dependency chain) =="
go mod why -m github.com/docker/docker

echo
echo "== modules that import/require docker/docker (small graph slice) =="
# Print only relevant edges around docker/docker
go mod graph | rg "github.com/docker/docker@" | head -n 50 || true

Repository: kubescape/node-agent

Length of output: 8415


major: Update vulnerable github.com/docker/docker v28.5.2+incompatible (indirect) pulled via inspektor-gadget

go.mod includes github.com/docker/docker v28.5.2+incompatible // indirect and go mod why -m github.com/docker/docker traces it to github.com/kubescape/node-agent/pkg/containerwatcher/v2github.com/inspektor-gadget/inspektor-gadget/pkg/container-utils/dockergithub.com/docker/docker/api/types/container.

GitHub advisory data shows HIGH issues affecting this version:

  • AuthZ plugin bypass with oversized request bodies: fixed in 29.3.1 (< 29.3.1)
  • docker cp race condition (bind mount redirection to host path): affects <= 28.5.2; no patched version listed in advisory data
  • PUT /containers/{id}/archive executes container binary on the host: affects <= 28.5.2; no patched version listed in advisory data

Update github.com/docker/docker to >= 29.3.1 at minimum, and bump further once the upstream patched versions for the docker cp and PUT .../archive HIGH issues are identified.

🧰 Tools
🪛 OSV Scanner (2.3.8)

[HIGH] 209-209: github.com/docker/docker 28.5.2+incompatible: Moby has an Off-by-one error in its plugin privilege validation in github.com/docker/docker

(GO-2026-4883)


[HIGH] 209-209: github.com/docker/docker 28.5.2+incompatible: Moby has AuthZ plugin bypass when provided oversized request bodies in github.com/docker/docker

(GO-2026-4887)


[HIGH] 209-209: github.com/docker/docker 28.5.2+incompatible: Moby has an Off-by-one error in its plugin privilege validation

(GHSA-pxq6-2prw-chj9)


[HIGH] 209-209: github.com/docker/docker 28.5.2+incompatible: Docker: Race condition in docker cp allows bind mount redirection to host path

(GHSA-rg2x-37c3-w2rh)


[HIGH] 209-209: github.com/docker/docker 28.5.2+incompatible: Docker: Race condition in docker cp allows creation of arbitrary empty files on the host via symlink swap

(GHSA-vp62-88p7-qqf5)


[HIGH] 209-209: github.com/docker/docker 28.5.2+incompatible: Moby has AuthZ plugin bypass when provided oversized request bodies

(GHSA-x744-4wpc-v9h2)


[HIGH] 209-209: github.com/docker/docker 28.5.2+incompatible: Docker: PUT /containers/{id}/archive executes container binary on the host

(GHSA-x86f-5xw2-fm2r)

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@go.mod` at line 209, The go.mod currently pins the indirect module
github.com/docker/docker v28.5.2+incompatible which contains HIGH-severity
vulnerabilities; update the dependency to at least v29.3.1 by replacing or
bumping github.com/docker/docker to >= v29.3.1 (and ideally a later patched
release) and then run go mod tidy to resolve the graph—if the direct introducer
is github.com/kubescape/node-agent/pkg/containerwatcher/v2 or
github.com/inspektor-gadget/inspektor-gadget/pkg/container-utils/docker, update
those modules (or add a replace directive for github.com/docker/docker) so the
resolved version is >= v29.3.1 and re-run tests/build to ensure compatibility.

Source: Linters/SAST tools

github.com/docker/docker-credential-helpers v0.9.3 // indirect
github.com/docker/docker-credential-helpers v0.9.5 // indirect
github.com/docker/go-connections v0.6.0 // indirect
github.com/docker/go-events v0.0.0-20250114142523-c867878c5e32 // indirect
github.com/docker/go-units v0.5.0 // indirect
github.com/dsnet/compress v0.0.2-0.20230904184137-39efe44ab707 // indirect
github.com/elliotchance/phpserialize v1.4.0 // indirect
github.com/emicklei/go-restful/v3 v3.12.2 // indirect
github.com/emicklei/go-restful/v3 v3.13.0 // indirect
github.com/emirpasic/gods v1.18.1 // indirect
github.com/envoyproxy/go-control-plane/envoy v1.36.0 // indirect
github.com/envoyproxy/protoc-gen-validate v1.3.0 // indirect
Expand All @@ -223,9 +223,9 @@ require (
github.com/francoispqt/gojay v1.2.13 // indirect
github.com/fsnotify/fsnotify v1.9.0 // indirect
github.com/fxamacker/cbor/v2 v2.9.0 // indirect
github.com/gabriel-vasile/mimetype v1.4.10 // indirect
github.com/gabriel-vasile/mimetype v1.4.13 // indirect
github.com/gammazero/deque v1.0.0 // indirect
github.com/github/go-spdx/v2 v2.3.3 // indirect
github.com/github/go-spdx/v2 v2.4.0 // indirect
github.com/go-asn1-ber/asn1-ber v1.5.7 // indirect
github.com/go-errors/errors v1.5.1 // indirect
github.com/go-fonts/liberation v0.3.2 // indirect
Expand All @@ -248,12 +248,12 @@ require (
github.com/go-openapi/validate v0.24.0 // indirect
github.com/go-pdf/fpdf v0.9.0 // indirect
github.com/go-restruct/restruct v1.2.0-alpha // indirect
github.com/go-viper/mapstructure/v2 v2.4.0 // indirect
github.com/go-viper/mapstructure/v2 v2.5.0 // indirect
github.com/goccy/go-yaml v1.18.0 // indirect
github.com/godbus/dbus/v5 v5.2.0 // indirect
github.com/gofrs/flock v0.13.0 // indirect
github.com/gogo/protobuf v1.3.2 // indirect
github.com/gohugoio/hashstructure v0.5.0 // indirect
github.com/gohugoio/hashstructure v0.6.0 // indirect
github.com/golang-jwt/jwt/v4 v4.5.2 // indirect
github.com/golang/freetype v0.0.0-20170609003504-e2365dfdc4a0 // indirect
github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect
Expand Down Expand Up @@ -327,7 +327,7 @@ require (
github.com/muesli/termenv v0.16.0 // indirect
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f // indirect
github.com/ncruces/go-strftime v0.1.9 // indirect
github.com/ncruces/go-strftime v1.0.0 // indirect
github.com/ncw/directio v1.0.5 // indirect
github.com/nix-community/go-nix v0.0.0-20250101154619-4bdde671e0a1 // indirect
github.com/notaryproject/notation-core-go v1.3.0 // indirect
Expand All @@ -342,7 +342,7 @@ require (
github.com/olekukonko/tablewriter v1.0.9 // indirect
github.com/olvrng/ujson v1.1.0 // indirect
github.com/opcoder0/capabilities v0.0.0-20221222060822-17fd73bffd2a // indirect
github.com/opencontainers/runtime-spec v1.2.1 // indirect
github.com/opencontainers/runtime-spec v1.3.0 // indirect
github.com/opencontainers/selinux v1.13.1 // indirect
github.com/opentracing/opentracing-go v1.2.1-0.20220228012449-10b1cf09e00b // indirect
github.com/packetcap/go-pcap v0.0.0-20250723190045-d00b185f30b7 // indirect
Expand Down Expand Up @@ -391,7 +391,7 @@ require (
github.com/stretchr/objx v0.5.2 // indirect
github.com/stripe/stripe-go/v74 v74.30.0 // indirect
github.com/subosito/gotenv v1.6.0 // indirect
github.com/sylabs/sif/v2 v2.22.0 // indirect
github.com/sylabs/sif/v2 v2.24.0 // indirect
github.com/sylabs/squashfs v1.0.6 // indirect
github.com/therootcompany/xz v1.0.1 // indirect
github.com/ulikunitz/xz v0.5.15 // indirect
Expand All @@ -405,7 +405,7 @@ require (
github.com/vishvananda/netlink v1.3.1 // indirect
github.com/vishvananda/netns v0.0.5 // indirect
github.com/wagoodman/go-partybus v0.0.0-20230516145632-8ccac152c651 // indirect
github.com/wagoodman/go-progress v0.0.0-20230925121702-07e42b3cdba0 // indirect
github.com/wagoodman/go-progress v0.0.0-20260303201901-10176f79b2c0 // indirect
github.com/x448/float16 v0.8.4 // indirect
github.com/xanzy/ssh-agent v0.3.3 // indirect
github.com/xi2/xz v0.0.0-20171230120015-48954b6210f8 // indirect
Expand All @@ -429,7 +429,6 @@ require (
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.43.0 // indirect
go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.43.0 // indirect
go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.43.0 // indirect
go.opentelemetry.io/otel/log/logtest v0.19.0 // indirect
go.opentelemetry.io/otel/sdk/log v0.19.0 // indirect
go.opentelemetry.io/proto/otlp v1.10.0 // indirect
go.uber.org/zap v1.27.1 // indirect
Expand All @@ -455,14 +454,15 @@ require (
gopkg.in/inf.v0 v0.9.1 // indirect
gopkg.in/warnings.v0 v0.1.2 // indirect
gopkg.in/yaml.v2 v2.4.0 // indirect
gopkg.in/yaml.v3 v3.0.1 // indirect
k8s.io/apiextensions-apiserver v0.35.0 // indirect
k8s.io/apiserver v0.35.0 // indirect
k8s.io/cli-runtime v0.35.0 // indirect
k8s.io/component-base v0.35.0 // indirect
k8s.io/klog/v2 v2.130.1 // indirect
k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912 // indirect
k8s.io/kubelet v0.35.0 // indirect
modernc.org/libc v1.66.3 // indirect
modernc.org/libc v1.67.6 // indirect
modernc.org/mathutil v1.7.1 // indirect
modernc.org/memory v1.11.0 // indirect
sigs.k8s.io/controller-runtime v0.21.0 // indirect
Expand All @@ -479,3 +479,7 @@ replace github.com/inspektor-gadget/inspektor-gadget => github.com/matthyx/inspe
replace github.com/cilium/ebpf => github.com/matthyx/ebpf v0.0.0-20260421101317-8a32d06def6c

replace github.com/anchore/syft => github.com/kubescape/syft v1.32.0-ks.2

replace github.com/opencontainers/runtime-spec => github.com/opencontainers/runtime-spec v1.2.1

replace github.com/anchore/stereoscope => github.com/anchore/stereoscope v0.1.9-0.20250826202322-ef061ea78385
Loading
Loading