chore: fix various security vulnerabilities in container-logger, docker-puller, docker-pusher, template-engine (#686)

vadim-kharin-codefresh · web-flow · commit f139d6807fa1 · 2026-04-30T12:41:12.000+03:00
diff --git a/charts/cf-runtime/Chart.yaml b/charts/cf-runtime/Chart.yaml
@@ -1,7 +1,7 @@
 apiVersion: v2
 description: A Helm chart for Codefresh Runner
 name: cf-runtime
-version: 10.0.16
+version: 10.0.17
 keywords:
   - codefresh
   - runner
@@ -18,15 +18,15 @@ annotations:
   # Supported kinds: `added`, `changed`, `deprecated`, `removed`, `fixed`, `security`:
   artifacthub.io/changes: |
     - kind: changed
-      description: 'update "cf-docker-builder" to v1.6.0'
+      description: 'update "container-logger" to 2.0.12'
     - kind: changed
-      description: 'update "compose" to v5.1.3-1.6.3'
+      description: 'update "docker-puller" to 8.0.27'
     - kind: changed
-      description: 'update "dind" to 29.4.1-3.0.14'
-    - kind: security
-      description: 'fix various security vulnerabilities in cf-docker-builder, compose and dind.'
+      description: 'update "docker-pusher" to 6.0.25'
     - kind: changed
-      description: 'update "tonistiigi/binfmt" to qemu-v10.2.1'
+      description: 'update "template-engine" to 0.15.0'
+    - kind: security
+      description: 'fix various security vulnerabilities in container-logger, docker-puller, docker-pusher and template-engine'
 dependencies:
   - name: cf-common
     repository: oci://quay.io/codefresh/charts
diff --git a/charts/cf-runtime/README.md b/charts/cf-runtime/README.md
@@ -1,6 +1,6 @@
 ## Codefresh Runner
 
-![Version: 10.0.16](https://img.shields.io/badge/Version-10.0.16-informational?style=flat-square)
+![Version: 10.0.17](https://img.shields.io/badge/Version-10.0.17-informational?style=flat-square)
 
 Helm chart for deploying [Codefresh Runner](https://codefresh.io/docs/docs/installation/codefresh-runner/) to Kubernetes.
 
@@ -1351,7 +1351,7 @@ Install the Helm chart
 | runtime.dind.userVolumeMounts | object | `{}` | Add extra volume mounts |
 | runtime.dind.userVolumes | object | `{}` | Add extra volumes |
 | runtime.dindDaemon | object | See below | DinD pod daemon config |
-| runtime.engine | object | `{"affinity":{},"command":["node","dist/server/index.js"],"env":{"CF_TELEMETRY_LOGS_LEVEL":"debug","CF_TELEMETRY_OTEL_ALLOW_HTTP_INSTRUMENTATION":"false","CF_TELEMETRY_OTEL_ENABLE":"true","CF_TELEMETRY_PROMETHEUS_ENABLE":"false","CF_TELEMETRY_PROMETHEUS_ENABLE_PROCESS_METRICS":"false","CF_TELEMETRY_PROMETHEUS_HOST":"0.0.0.0","CF_TELEMETRY_PROMETHEUS_PORT":"9100","CF_TELEMETRY_PYROSCOPE_ENABLE":"false","CONTAINER_LOGGER_EXEC_CHECK_INTERVAL_MS":1000,"DOCKER_REQUEST_TIMEOUT_MS":30000,"FORCE_COMPOSE_SERIAL_PULL":false,"LOGGER_LEVEL":"debug","LOG_OUTGOING_HTTP_REQUESTS":false,"METRICS_SCRAPE_TIMEOUT_MS":"0","OTEL_EXPORTER_OTLP_COMPRESSION":"gzip","OTEL_EXPORTER_OTLP_ENDPOINT":"http://localhost:4317","OTEL_EXPORTER_OTLP_PROTOCOL":"grpc","OTEL_EXPORTER_PROMETHEUS_HOST":"0.0.0.0","OTEL_EXPORTER_PROMETHEUS_PORT":"9464","OTEL_LOGS_EXPORTER":"none","OTEL_METRICS_EXPORTER":"otlp","OTEL_METRIC_EXPORT_INTERVAL":"10000","OTEL_METRIC_EXPORT_TIMEOUT":"5000","OTEL_SEMCONV_STABILITY_OPT_IN":"http","OTEL_TRACES_EXPORTER":"none","OTEL_TRACES_SAMPLER":"parentbased_always_on","PYROSCOPE_SERVER_ADDRESS":"","TRUSTED_QEMU_IMAGES":"tonistiigi/binfmt"},"image":{"digest":"sha256:c264a5f83156cbca2124930286bb584be09c060cd1b9739d6d0e0ebf0aa94065","pullPolicy":"IfNotPresent","registry":"quay.io","repository":"codefresh/engine","tag":"3.2.5"},"nodeSelector":{},"podAnnotations":{},"podLabels":{},"resources":{"limits":{"cpu":"1000m","memory":"2048Mi"},"requests":{"cpu":"100m","memory":"128Mi"}},"runtimeImages":{"alpine":{"digest":"sha256:9a341ff2287c54b86425cbee0141114d811ae69d88a36019087be6d896cef241","registry":"docker.io","repository":"alpine","tag":"edge"},"compose":{"digest":"sha256:950ab2a3d8986f95ac84c0d67e5052f97c426bc487470c7b6f46c846a9bd78ac","registry":"quay.io","repository":"codefresh/compose","tag":"v5.1.3-1.6.3"},"container-logger":{"digest":"sha256:d5c028973cdb9ec7250014a2ced1ed31106fc5c1010207a7d08cd7099058aaf2","registry":"quay.io","repository":"codefresh/cf-container-logger","tag":"2.0.10"},"cosign-image-signer":{"digest":"sha256:85ce347ad7b11a7e324ca64e38b0701bc6fb739bfcbb67a3b4657ef36939e623","registry":"quay.io","repository":"codefresh/cf-cosign-image-signer","tag":"3.0.6-cf.1"},"default-qemu":{"digest":"sha256:d3b963f787999e6c0219a48dba02978769286ff61a5f4d26245cb6a6e5567ea3","registry":"docker.io","repository":"tonistiigi/binfmt","tag":"qemu-v10.2.1"},"docker-builder":{"digest":"sha256:31c605a6df7898e1e35ca57dcbe47ee314903ba28aab651cb6913ba43ade21a2","registry":"quay.io","repository":"codefresh/cf-docker-builder","tag":"1.6.0"},"docker-puller":{"digest":"sha256:a518ca194d85d5f254954f201e33f6cd4cd1a82d552fce8cdceabbaf12786cb3","registry":"quay.io","repository":"codefresh/cf-docker-puller","tag":"8.0.26"},"docker-pusher":{"digest":"sha256:199053e81fbba18363f4f7081b48b6da61b02d794ff8a914707710cd867bed96","registry":"quay.io","repository":"codefresh/cf-docker-pusher","tag":"6.0.24"},"fs-ops":{"digest":"sha256:5f954c1f4618dbcebf1c3ef7b9185c6e1c9bb14b0aad3d2830cfeb715541bf47","registry":"quay.io","repository":"codefresh/fs-ops","tag":"1.2.12"},"gc-builder":{"digest":"sha256:73d0bab42a59381b7b4894c6461f579083f48895906e17a3ac4e828044217fe0","registry":"quay.io","repository":"codefresh/gcloud-builder","tag":"0.5.8"},"git-cloner":{"digest":"sha256:7270f5c451b72fce34d358a1a7b377c43bc9a28959f3771d5dd666959fb18177","registry":"quay.io","repository":"codefresh/cf-git-cloner","tag":"10.3.10"},"kube-deploy":{"digest":"sha256:beb578bbe5bbf66c034c51937c909d16faf473225815ce416188176d363ec15d","registry":"quay.io","repository":"codefresh/cf-deploy-kubernetes","tag":"17.0.4"},"pipeline-debugger":{"digest":"sha256:2dbf79a87f641507fc2111d4ff01e046954bca2f31e41ebc1e9cda96b1189780","registry":"quay.io","repository":"codefresh/cf-debugger","tag":"1.3.13"},"template-engine":{"digest":"sha256:fc1dc409ceef47ffdc5a8779851ac201c8c0322fea1b80d0cb6a0a99da9c4c6b","registry":"quay.io","repository":"codefresh/pikolo","tag":"0.14.11"}},"runtimeImagesRegistry":"","schedulerName":"","serviceAccount":"codefresh-engine","terminationGracePeriodSeconds":180,"tolerations":[],"userEnvVars":[],"workflowLimits":{"MAXIMUM_ALLOWED_TIME_BEFORE_PRE_STEPS_SUCCESS":600,"MAXIMUM_ALLOWED_WORKFLOW_AGE_BEFORE_TERMINATION":86400,"MAXIMUM_ELECTED_STATE_AGE_ALLOWED":900,"MAXIMUM_POST_STEPS_GRACE_PERIOD_MINUTES":30,"MAXIMUM_RETRY_ATTEMPTS_ALLOWED":20,"MAXIMUM_TERMINATING_STATE_AGE_ALLOWED":900,"MAXIMUM_TERMINATING_STATE_AGE_ALLOWED_WITHOUT_UPDATE":300,"TIME_ENGINE_INACTIVE_UNTIL_TERMINATION":300,"TIME_ENGINE_INACTIVE_UNTIL_UNHEALTHY":60,"TIME_INACTIVE_UNTIL_TERMINATION":2700}}` | Parameters for Engine pod (aka "pipeline" orchestrator). |
+| runtime.engine | object | `{"affinity":{},"command":["node","dist/server/index.js"],"env":{"CF_TELEMETRY_LOGS_LEVEL":"debug","CF_TELEMETRY_OTEL_ALLOW_HTTP_INSTRUMENTATION":"false","CF_TELEMETRY_OTEL_ENABLE":"true","CF_TELEMETRY_PROMETHEUS_ENABLE":"false","CF_TELEMETRY_PROMETHEUS_ENABLE_PROCESS_METRICS":"false","CF_TELEMETRY_PROMETHEUS_HOST":"0.0.0.0","CF_TELEMETRY_PROMETHEUS_PORT":"9100","CF_TELEMETRY_PYROSCOPE_ENABLE":"false","CONTAINER_LOGGER_EXEC_CHECK_INTERVAL_MS":1000,"DOCKER_REQUEST_TIMEOUT_MS":30000,"FORCE_COMPOSE_SERIAL_PULL":false,"LOGGER_LEVEL":"debug","LOG_OUTGOING_HTTP_REQUESTS":false,"METRICS_SCRAPE_TIMEOUT_MS":"0","OTEL_EXPORTER_OTLP_COMPRESSION":"gzip","OTEL_EXPORTER_OTLP_ENDPOINT":"http://localhost:4317","OTEL_EXPORTER_OTLP_PROTOCOL":"grpc","OTEL_EXPORTER_PROMETHEUS_HOST":"0.0.0.0","OTEL_EXPORTER_PROMETHEUS_PORT":"9464","OTEL_LOGS_EXPORTER":"none","OTEL_METRICS_EXPORTER":"otlp","OTEL_METRIC_EXPORT_INTERVAL":"10000","OTEL_METRIC_EXPORT_TIMEOUT":"5000","OTEL_SEMCONV_STABILITY_OPT_IN":"http","OTEL_TRACES_EXPORTER":"none","OTEL_TRACES_SAMPLER":"parentbased_always_on","PYROSCOPE_SERVER_ADDRESS":"","TRUSTED_QEMU_IMAGES":"tonistiigi/binfmt"},"image":{"digest":"sha256:c264a5f83156cbca2124930286bb584be09c060cd1b9739d6d0e0ebf0aa94065","pullPolicy":"IfNotPresent","registry":"quay.io","repository":"codefresh/engine","tag":"3.2.5"},"nodeSelector":{},"podAnnotations":{},"podLabels":{},"resources":{"limits":{"cpu":"1000m","memory":"2048Mi"},"requests":{"cpu":"100m","memory":"128Mi"}},"runtimeImages":{"alpine":{"digest":"sha256:9a341ff2287c54b86425cbee0141114d811ae69d88a36019087be6d896cef241","registry":"docker.io","repository":"alpine","tag":"edge"},"compose":{"digest":"sha256:950ab2a3d8986f95ac84c0d67e5052f97c426bc487470c7b6f46c846a9bd78ac","registry":"quay.io","repository":"codefresh/compose","tag":"v5.1.3-1.6.3"},"container-logger":{"digest":"sha256:d666502f8bb95a00a1a598dd33ccdd10927ae73d32a5eed278d476bb1c7140a4","registry":"quay.io","repository":"codefresh/cf-container-logger","tag":"2.0.12"},"cosign-image-signer":{"digest":"sha256:85ce347ad7b11a7e324ca64e38b0701bc6fb739bfcbb67a3b4657ef36939e623","registry":"quay.io","repository":"codefresh/cf-cosign-image-signer","tag":"3.0.6-cf.1"},"default-qemu":{"digest":"sha256:d3b963f787999e6c0219a48dba02978769286ff61a5f4d26245cb6a6e5567ea3","registry":"docker.io","repository":"tonistiigi/binfmt","tag":"qemu-v10.2.1"},"docker-builder":{"digest":"sha256:31c605a6df7898e1e35ca57dcbe47ee314903ba28aab651cb6913ba43ade21a2","registry":"quay.io","repository":"codefresh/cf-docker-builder","tag":"1.6.0"},"docker-puller":{"digest":"sha256:818773818053553505afbaf109bf67f1b22bdb80307e155d27d4f06eab3c3246","registry":"quay.io","repository":"codefresh/cf-docker-puller","tag":"8.0.27"},"docker-pusher":{"digest":"sha256:711ff93efa44135195466b3338ece12e1322e68dc742fb1e23e75ad0701a3696","registry":"quay.io","repository":"codefresh/cf-docker-pusher","tag":"6.0.25"},"fs-ops":{"digest":"sha256:5f954c1f4618dbcebf1c3ef7b9185c6e1c9bb14b0aad3d2830cfeb715541bf47","registry":"quay.io","repository":"codefresh/fs-ops","tag":"1.2.12"},"gc-builder":{"digest":"sha256:73d0bab42a59381b7b4894c6461f579083f48895906e17a3ac4e828044217fe0","registry":"quay.io","repository":"codefresh/gcloud-builder","tag":"0.5.8"},"git-cloner":{"digest":"sha256:7270f5c451b72fce34d358a1a7b377c43bc9a28959f3771d5dd666959fb18177","registry":"quay.io","repository":"codefresh/cf-git-cloner","tag":"10.3.10"},"kube-deploy":{"digest":"sha256:beb578bbe5bbf66c034c51937c909d16faf473225815ce416188176d363ec15d","registry":"quay.io","repository":"codefresh/cf-deploy-kubernetes","tag":"17.0.4"},"pipeline-debugger":{"digest":"sha256:2dbf79a87f641507fc2111d4ff01e046954bca2f31e41ebc1e9cda96b1189780","registry":"quay.io","repository":"codefresh/cf-debugger","tag":"1.3.13"},"template-engine":{"digest":"sha256:10f61a9c9eac46d4db982b42f9af1e21a3bcd9f283943a9025ff50f2308a1861","registry":"quay.io","repository":"codefresh/pikolo","tag":"0.15.0"}},"runtimeImagesRegistry":"","schedulerName":"","serviceAccount":"codefresh-engine","terminationGracePeriodSeconds":180,"tolerations":[],"userEnvVars":[],"workflowLimits":{"MAXIMUM_ALLOWED_TIME_BEFORE_PRE_STEPS_SUCCESS":600,"MAXIMUM_ALLOWED_WORKFLOW_AGE_BEFORE_TERMINATION":86400,"MAXIMUM_ELECTED_STATE_AGE_ALLOWED":900,"MAXIMUM_POST_STEPS_GRACE_PERIOD_MINUTES":30,"MAXIMUM_RETRY_ATTEMPTS_ALLOWED":20,"MAXIMUM_TERMINATING_STATE_AGE_ALLOWED":900,"MAXIMUM_TERMINATING_STATE_AGE_ALLOWED_WITHOUT_UPDATE":300,"TIME_ENGINE_INACTIVE_UNTIL_TERMINATION":300,"TIME_ENGINE_INACTIVE_UNTIL_UNHEALTHY":60,"TIME_INACTIVE_UNTIL_TERMINATION":2700}}` | Parameters for Engine pod (aka "pipeline" orchestrator). |
 | runtime.engine.affinity | object | `{}` | Set affinity |
 | runtime.engine.command | list | `["node","dist/server/index.js"]` | Set container command. |
 | runtime.engine.env | object | `{"CF_TELEMETRY_LOGS_LEVEL":"debug","CF_TELEMETRY_OTEL_ALLOW_HTTP_INSTRUMENTATION":"false","CF_TELEMETRY_OTEL_ENABLE":"true","CF_TELEMETRY_PROMETHEUS_ENABLE":"false","CF_TELEMETRY_PROMETHEUS_ENABLE_PROCESS_METRICS":"false","CF_TELEMETRY_PROMETHEUS_HOST":"0.0.0.0","CF_TELEMETRY_PROMETHEUS_PORT":"9100","CF_TELEMETRY_PYROSCOPE_ENABLE":"false","CONTAINER_LOGGER_EXEC_CHECK_INTERVAL_MS":1000,"DOCKER_REQUEST_TIMEOUT_MS":30000,"FORCE_COMPOSE_SERIAL_PULL":false,"LOGGER_LEVEL":"debug","LOG_OUTGOING_HTTP_REQUESTS":false,"METRICS_SCRAPE_TIMEOUT_MS":"0","OTEL_EXPORTER_OTLP_COMPRESSION":"gzip","OTEL_EXPORTER_OTLP_ENDPOINT":"http://localhost:4317","OTEL_EXPORTER_OTLP_PROTOCOL":"grpc","OTEL_EXPORTER_PROMETHEUS_HOST":"0.0.0.0","OTEL_EXPORTER_PROMETHEUS_PORT":"9464","OTEL_LOGS_EXPORTER":"none","OTEL_METRICS_EXPORTER":"otlp","OTEL_METRIC_EXPORT_INTERVAL":"10000","OTEL_METRIC_EXPORT_TIMEOUT":"5000","OTEL_SEMCONV_STABILITY_OPT_IN":"http","OTEL_TRACES_EXPORTER":"none","OTEL_TRACES_SAMPLER":"parentbased_always_on","PYROSCOPE_SERVER_ADDRESS":"","TRUSTED_QEMU_IMAGES":"tonistiigi/binfmt"}` | Set additional env vars. |
diff --git a/charts/cf-runtime/values.yaml b/charts/cf-runtime/values.yaml
@@ -535,8 +535,8 @@ runtime:
       container-logger:
         registry: quay.io
         repository: codefresh/cf-container-logger
-        tag: 2.0.10
-        digest: sha256:d5c028973cdb9ec7250014a2ced1ed31106fc5c1010207a7d08cd7099058aaf2
+        tag: 2.0.12
+        digest: sha256:d666502f8bb95a00a1a598dd33ccdd10927ae73d32a5eed278d476bb1c7140a4
       docker-builder:
         registry: quay.io
         repository: codefresh/cf-docker-builder
@@ -545,13 +545,13 @@ runtime:
       docker-puller:
         registry: quay.io
         repository: codefresh/cf-docker-puller
-        tag: 8.0.26
-        digest: sha256:a518ca194d85d5f254954f201e33f6cd4cd1a82d552fce8cdceabbaf12786cb3
+        tag: 8.0.27
+        digest: sha256:818773818053553505afbaf109bf67f1b22bdb80307e155d27d4f06eab3c3246
       docker-pusher:
         registry: quay.io
         repository: codefresh/cf-docker-pusher
-        tag: 6.0.24
-        digest: sha256:199053e81fbba18363f4f7081b48b6da61b02d794ff8a914707710cd867bed96
+        tag: 6.0.25
+        digest: sha256:711ff93efa44135195466b3338ece12e1322e68dc742fb1e23e75ad0701a3696
       fs-ops:
         registry: quay.io
         repository: codefresh/fs-ops
@@ -575,8 +575,8 @@ runtime:
       template-engine:
         registry: quay.io
         repository: codefresh/pikolo
-        tag: 0.14.11
-        digest: sha256:fc1dc409ceef47ffdc5a8779851ac201c8c0322fea1b80d0cb6a0a99da9c4c6b
+        tag: 0.15.0
+        digest: sha256:10f61a9c9eac46d4db982b42f9af1e21a3bcd9f283943a9025ff50f2308a1861
       cosign-image-signer:
         registry: quay.io
         repository: codefresh/cf-cosign-image-signer
