RHAIENG-2846 [3/3]: Hermetic Dockerfile + build patches + Tekton for codeserver - #2985

Merged

ysok merged 1 commit into

Feb 28, 2026

GitHub Advanced Security / Trivy failed Feb 28, 2026 in 3s

5 new alerts including 4 high severity security vulnerabilities

Security Alerts:

Alerts not introduced by this pull request might have been detected because the code changes were too large.

See annotations below for details.

Code scanning / Trivy

node-tar: tar: node-tar: Arbitrary file overwrite and symlink poisoning via unsanitized linkpaths in archives High library

Package: tar
Installed Version: 6.2.1
Vulnerability CVE-2026-23745
Severity: HIGH
Fixed Version: 7.5.3
Link: CVE-2026-23745

Code scanning / Trivy

node-tar: tar: node-tar: Arbitrary file overwrite via Unicode path collision race condition High library

Package: tar
Installed Version: 6.2.1
Vulnerability CVE-2026-23950
Severity: HIGH
Fixed Version: 7.5.4
Link: CVE-2026-23950

Code scanning / Trivy

node-tar: tar: node-tar: Arbitrary file creation via path traversal bypass in hardlink security check High library

Package: tar
Installed Version: 6.2.1
Vulnerability CVE-2026-24842
Severity: HIGH
Fixed Version: 7.5.7
Link: CVE-2026-24842

Code scanning / Trivy

node-tar: node-tar: Arbitrary file read/write via malicious archive hardlink creation High library

Package: tar
Installed Version: 6.2.1
Vulnerability CVE-2026-26960
Severity: HIGH
Fixed Version: 7.5.8
Link: CVE-2026-26960

Code scanning / Trivy

undici: Undici: Denial of Service via excessive decompression steps Medium library

Package: undici
Installed Version: 7.9.0
Vulnerability CVE-2026-22036
Severity: MEDIUM
Fixed Version: 7.18.2, 6.23.0
Link: CVE-2026-22036