Repository navigation
fix: remediate HTTP/2 CVEs in MySQL operator images - #27
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The published operator and
orc-helperbinaries still embedgolang.org/x/net v0.14.0, leaving the HTTP/2 findings in DCE5-8555 unresolved. Update the shared module tox/net v0.62.0and build both programs with pinned Go 1.27.3 builders.Build the operator from the checked-out source and use its production Dockerfile in PR E2E, so the tests exercise the same build path used for releases. Update the local E2E instructions and fix two legacy test formatting calls rejected by the newer Go vet checks. Existing Orchestrator and dockerize source versions remain unchanged.
Validation
Compiled all packages and tests with
go test -p 2 -run '^$' ./....Passed the existing cluster-independent tests for internal packages and sidecar.
Built both images for linux/amd64 and linux/arm64; verified binary metadata and basic execution. Both Orchestrator images also passed default-entrypoint startup and
/api/lb-checkwith networking disabled.Scanned all four image/platform combinations using Trivy 0.75.0 and the same frozen 2026-10-29 database used for the old-image comparison. No findings for CVE-2023-39325, CVE-2023-44487 or CVE-2024-2961 remain, including the helper residual. The two HTTP/2 CVE IDs follow the established Go vendor mapping. Other scan findings are outside this change's scope.
PR CI run 41022543116 passed for head
6b2c449ac3d20c3e1a8edc2321fb3c9f7002d75a, tested as a merge with main. MySQL 5.7.44 / 8.0.37 / 8.4.9 each passed create/replication, configuration update and failover: 9 tests passed, 0 failed, 0 skipped. The native arm64 Orchestrator build and binary smoke checks also passed.This patch is based on main; upgrading an existing customer v0.7.3 deployment still needs separate regression validation.