Skip to content

Commit 2afdacf

Browse files
geroplona-agent
geropl
and
ona-agent
authored
Fix critical vulnerabilities in Node.js and Caddy base images (#21326)
* Fix critical vulnerabilities in Node.js and Caddy base images - Update Node.js from 22.15.1 to 22.22.0 in server, gitpod-db, ws-manager-bridge, and gitpod-web-extension Dockerfiles. Fixes CVE-2025-15467 (OpenSSL) and CVE-2025-55130 (Node.js). - Update Caddy from v2.11.0-beta.2 to v2.11.1 (stable) in proxy and ide-proxy Dockerfiles and all proxy plugin Go modules. Includes 6 security patches (CVE-2026-27585 through CVE-2026-27590). The image-builder-bob buildkit base image (ghcr.io/gitpod-io/buildkit:v0.20.1-gitpod.4) also has critical vulns (CVE-2025-15467, CVE-2025-22871, CVE-2025-68121) but requires a separate rebuild of that external image. Co-authored-by: Ona <no-reply@ona.com> * Update buildkit base image to v0.20.1-gitpod.5 Fixes CVE-2025-15467 (OpenSSL), CVE-2025-22871 and CVE-2025-68121 (Go stdlib) in the image-builder-bob Docker image. Co-authored-by: Ona <no-reply@ona.com> --------- Co-authored-by: Ona <no-reply@ona.com>
1 parent 56cd1a6 commit 2afdacf

File tree

27 files changed

+1772
-1724
lines changed

27 files changed

+1772
-1724
lines changed

‎components/gitpod-db/leeway.Dockerfile‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
# Licensed under the GNU Affero General Public License (AGPL).
33
# See License.AGPL.txt in the project root for license information.
44

5-
FROM node:22.15.1-alpine AS builder
5+
FROM node:22.22.0-alpine AS builder
66

77
# Install bash
88
RUN apk update && \
@@ -13,11 +13,11 @@ COPY components-gitpod-db--migrations /installer/
1313
WORKDIR /app
1414
RUN /installer/install.sh
1515

16-
FROM node:22.15.1-alpine as proxy
16+
FROM node:22.22.0-alpine as proxy
1717
RUN wget https://storage.googleapis.com/cloudsql-proxy/v1.37.6/cloud_sql_proxy.linux.amd64 -O /bin/cloud_sql_proxy \
1818
&& chmod +x /bin/cloud_sql_proxy
1919

20-
FROM node:22.15.1-alpine
20+
FROM node:22.22.0-alpine
2121

2222
# Install bash
2323
RUN apk update && \

‎components/ide-proxy/Dockerfile‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,9 +16,9 @@ RUN for FILE in `ls /bin/gitpod-local-companion*`;do \
1616
RUN mkdir -p static/code
1717
RUN curl -o static/code/marketplace.json "https://raw.githubusercontent.com/EclipseFdn/publish-extensions/d9a7cc2d486ca881e9df310324f9752f48156283/extension-control/extensions.json"
1818

19-
# Build Caddy from source to get v2.11.0-beta.2 with fixed smallstep/certificates
19+
# Build Caddy from source with v2.11.1 (includes security fixes)
2020
FROM caddy:builder AS caddy-builder
21-
RUN xcaddy build v2.11.0-beta.2 --output /caddy
21+
RUN xcaddy build v2.11.1 --output /caddy
2222

2323
FROM caddy/caddy:2.11-alpine
2424

‎components/ide/code/gitpod-web-extension/leeway.Dockerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
# Copyright (c) 2020 Gitpod GmbH. All rights reserved.
22
# Licensed under the GNU Affero General Public License (AGPL).
33
# See License.AGPL.txt in the project root for license information.
4-
FROM node:22.15.1 as builder
4+
FROM node:22.22.0 as builder
55

66
ARG CODE_EXTENSION_COMMIT
77

‎components/image-builder-bob/leeway.Dockerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
# Licensed under the GNU Affero General Public License (AGPL).
33
# See License.AGPL.txt in the project root for license information.
44

5-
FROM ghcr.io/gitpod-io/buildkit:v0.20.1-gitpod.4
5+
FROM ghcr.io/gitpod-io/buildkit:v0.20.1-gitpod.5
66

77
USER root
88
RUN apk --no-cache add sudo bash \

‎components/proxy/Dockerfile‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,16 +2,14 @@
22
# Licensed under the GNU Affero General Public License (AGPL).
33
# See License.AGPL.txt in the project root for license information.
44

5-
# TODO(gpl): Pin to v2.11.x once available
65
FROM caddy:builder AS builder
76

87
WORKDIR /plugins
98

109
COPY plugins /plugins
1110

1211
# build caddy
13-
# Using v2.11.0-beta.2 to fix critical vulnerability GHSA-h8cp-697h-8c8p in smallstep/certificates
14-
RUN xcaddy build v2.11.0-beta.2 \
12+
RUN xcaddy build v2.11.1 \
1513
--output /caddy \
1614
--with github.com/gitpod-io/gitpod/proxy/plugins/corsorigin=/plugins/corsorigin \
1715
--with github.com/gitpod-io/gitpod/proxy/plugins/secwebsocketkey=/plugins/secwebsocketkey \

‎components/proxy/plugins/analytics/go.mod‎

Lines changed: 42 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -1,38 +1,39 @@
11
module github.com/gitpod-io/gitpod/proxy/plugins/analytics
22

3-
go 1.25
3+
go 1.25.0
44

55
godebug tlsmlkem=0
66

77
require (
8-
github.com/caddyserver/caddy/v2 v2.11.0-beta.2
8+
github.com/caddyserver/caddy/v2 v2.11.1
99
go.uber.org/zap v1.27.1
1010
gopkg.in/segmentio/analytics-go.v3 v3.1.0
1111
)
1212

1313
require (
14-
cel.dev/expr v0.24.0 // indirect
15-
cloud.google.com/go/auth v0.17.0 // indirect
14+
cel.dev/expr v0.25.1 // indirect
15+
cloud.google.com/go/auth v0.18.1 // indirect
1616
cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect
1717
cloud.google.com/go/compute/metadata v0.9.0 // indirect
18-
dario.cat/mergo v1.0.1 // indirect
19-
filippo.io/edwards25519 v1.1.0 // indirect
18+
dario.cat/mergo v1.0.2 // indirect
19+
filippo.io/bigmod v0.1.0 // indirect
20+
filippo.io/edwards25519 v1.2.0 // indirect
2021
github.com/AndreasBriese/bbloom v0.0.0-20190825152654-46b345b51c96 // indirect
2122
github.com/KimMachineGun/automemlimit v0.7.5 // indirect
2223
github.com/Masterminds/goutils v1.1.1 // indirect
23-
github.com/Masterminds/semver/v3 v3.3.1 // indirect
24+
github.com/Masterminds/semver/v3 v3.4.0 // indirect
2425
github.com/Masterminds/sprig/v3 v3.3.0 // indirect
25-
github.com/antlr4-go/antlr/v4 v4.13.0 // indirect
26+
github.com/antlr4-go/antlr/v4 v4.13.1 // indirect
2627
github.com/aryann/difflib v0.0.0-20210328193216-ff5ff6dc229b // indirect
2728
github.com/beorn7/perks v1.0.1 // indirect
2829
github.com/bmizerany/assert v0.0.0-20160611221934-b7ed37b82869 // indirect
29-
github.com/caddyserver/certmagic v0.25.1 // indirect
30-
github.com/caddyserver/zerossl v0.1.4 // indirect
30+
github.com/caddyserver/certmagic v0.25.2 // indirect
31+
github.com/caddyserver/zerossl v0.1.5 // indirect
3132
github.com/ccoveille/go-safecast/v2 v2.0.0 // indirect
3233
github.com/cespare/xxhash v1.1.0 // indirect
3334
github.com/cespare/xxhash/v2 v2.3.0 // indirect
3435
github.com/chzyer/readline v1.5.1 // indirect
35-
github.com/cloudflare/circl v1.6.2 // indirect
36+
github.com/cloudflare/circl v1.6.3 // indirect
3637
github.com/coreos/go-oidc/v3 v3.17.0 // indirect
3738
github.com/cpuguy83/go-md2man/v2 v2.0.7 // indirect
3839
github.com/dgraph-io/badger v1.6.2 // indirect
@@ -48,26 +49,26 @@ require (
4849
github.com/go-sql-driver/mysql v1.8.1 // indirect
4950
github.com/golang/protobuf v1.5.4 // indirect
5051
github.com/golang/snappy v0.0.4 // indirect
51-
github.com/google/cel-go v0.26.1 // indirect
52+
github.com/google/cel-go v0.27.0 // indirect
5253
github.com/google/s2a-go v0.1.9 // indirect
5354
github.com/google/uuid v1.6.0 // indirect
54-
github.com/googleapis/enterprise-certificate-proxy v0.3.7 // indirect
55-
github.com/googleapis/gax-go/v2 v2.15.0 // indirect
55+
github.com/googleapis/enterprise-certificate-proxy v0.3.11 // indirect
56+
github.com/googleapis/gax-go/v2 v2.17.0 // indirect
5657
github.com/huandu/xstrings v1.5.0 // indirect
5758
github.com/inconshreveable/mousetrap v1.1.0 // indirect
5859
github.com/jackc/pgpassfile v1.0.0 // indirect
5960
github.com/jackc/pgservicefile v0.0.0-20221227161230-091c0ba34f0a // indirect
6061
github.com/jackc/pgx/v5 v5.6.0 // indirect
6162
github.com/jackc/puddle/v2 v2.2.1 // indirect
62-
github.com/klauspost/compress v1.18.2 // indirect
63+
github.com/klauspost/compress v1.18.4 // indirect
6364
github.com/klauspost/cpuid/v2 v2.3.0 // indirect
6465
github.com/libdns/libdns v1.1.1 // indirect
6566
github.com/manifoldco/promptui v0.9.0 // indirect
6667
github.com/mattn/go-colorable v0.1.14 // indirect
6768
github.com/mattn/go-isatty v0.0.20 // indirect
6869
github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d // indirect
69-
github.com/mholt/acmez/v3 v3.1.4 // indirect
70-
github.com/miekg/dns v1.1.69 // indirect
70+
github.com/mholt/acmez/v3 v3.1.6 // indirect
71+
github.com/miekg/dns v1.1.72 // indirect
7172
github.com/mitchellh/copystructure v1.2.0 // indirect
7273
github.com/mitchellh/go-ps v1.0.0 // indirect
7374
github.com/mitchellh/reflectwalk v1.0.2 // indirect
@@ -76,17 +77,17 @@ require (
7677
github.com/pkg/errors v0.9.1 // indirect
7778
github.com/prometheus/client_golang v1.23.2 // indirect
7879
github.com/prometheus/client_model v0.6.2 // indirect
79-
github.com/prometheus/common v0.67.4 // indirect
80+
github.com/prometheus/common v0.67.5 // indirect
8081
github.com/prometheus/procfs v0.19.2 // indirect
8182
github.com/quic-go/qpack v0.6.0 // indirect
82-
github.com/quic-go/quic-go v0.58.0 // indirect
83+
github.com/quic-go/quic-go v0.59.0 // indirect
8384
github.com/rs/xid v1.6.0 // indirect
8485
github.com/russross/blackfriday/v2 v2.1.0 // indirect
8586
github.com/segmentio/backo-go v1.0.1 // indirect
8687
github.com/shopspring/decimal v1.4.0 // indirect
8788
github.com/shurcooL/sanitized_anchor_name v1.0.0 // indirect
88-
github.com/slackhq/nebula v1.9.7 // indirect
89-
github.com/smallstep/certificates v0.29.0 // indirect
89+
github.com/slackhq/nebula v1.10.3 // indirect
90+
github.com/smallstep/certificates v0.30.0-rc2.0.20260211214201-20608299c29c // indirect
9091
github.com/smallstep/cli-utils v0.12.2 // indirect
9192
github.com/smallstep/linkedca v0.25.0 // indirect
9293
github.com/smallstep/nosql v0.7.0 // indirect
@@ -96,41 +97,40 @@ require (
9697
github.com/spf13/cast v1.7.0 // indirect
9798
github.com/spf13/cobra v1.10.2 // indirect
9899
github.com/spf13/pflag v1.0.10 // indirect
99-
github.com/stoewer/go-strcase v1.2.0 // indirect
100100
github.com/tailscale/go-winio v0.0.0-20231025203758-c4f33415bf55 // indirect
101101
github.com/tailscale/tscert v0.0.0-20251216020129-aea342f6d747 // indirect
102102
github.com/urfave/cli v1.22.17 // indirect
103103
github.com/xtgo/uuid v0.0.0-20140804021211-a0b114877d4c // indirect
104104
github.com/zeebo/blake3 v0.2.4 // indirect
105105
go.etcd.io/bbolt v1.3.10 // indirect
106106
go.opentelemetry.io/auto/sdk v1.2.1 // indirect
107-
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.64.0 // indirect
108-
go.opentelemetry.io/otel v1.39.0 // indirect
109-
go.opentelemetry.io/otel/metric v1.39.0 // indirect
110-
go.opentelemetry.io/otel/trace v1.39.0 // indirect
111-
go.step.sm/crypto v0.75.0 // indirect
107+
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.65.0 // indirect
108+
go.opentelemetry.io/otel v1.40.0 // indirect
109+
go.opentelemetry.io/otel/metric v1.40.0 // indirect
110+
go.opentelemetry.io/otel/trace v1.40.0 // indirect
111+
go.step.sm/crypto v0.76.2 // indirect
112112
go.uber.org/automaxprocs v1.6.0 // indirect
113113
go.uber.org/multierr v1.11.0 // indirect
114114
go.uber.org/zap/exp v0.3.0 // indirect
115115
go.yaml.in/yaml/v2 v2.4.3 // indirect
116116
go.yaml.in/yaml/v3 v3.0.4 // indirect
117-
golang.org/x/crypto v0.46.0 // indirect
118-
golang.org/x/crypto/x509roots/fallback v0.0.0-20250927194341-2beaa59a3c99 // indirect
119-
golang.org/x/exp v0.0.0-20250813145105-42675adae3e6 // indirect
120-
golang.org/x/mod v0.30.0 // indirect
121-
golang.org/x/net v0.48.0 // indirect
122-
golang.org/x/oauth2 v0.33.0 // indirect
117+
golang.org/x/crypto v0.48.0 // indirect
118+
golang.org/x/crypto/x509roots/fallback v0.0.0-20260213171211-a408498e5541 // indirect
119+
golang.org/x/exp v0.0.0-20251023183803-a4bb9ffd2546 // indirect
120+
golang.org/x/mod v0.33.0 // indirect
121+
golang.org/x/net v0.50.0 // indirect
122+
golang.org/x/oauth2 v0.34.0 // indirect
123123
golang.org/x/sync v0.19.0 // indirect
124-
golang.org/x/sys v0.39.0 // indirect
125-
golang.org/x/term v0.38.0 // indirect
126-
golang.org/x/text v0.32.0 // indirect
124+
golang.org/x/sys v0.41.0 // indirect
125+
golang.org/x/term v0.40.0 // indirect
126+
golang.org/x/text v0.34.0 // indirect
127127
golang.org/x/time v0.14.0 // indirect
128-
golang.org/x/tools v0.39.0 // indirect
129-
google.golang.org/api v0.256.0 // indirect
130-
google.golang.org/genproto/googleapis/api v0.0.0-20251202230838-ff82c1b0f217 // indirect
131-
google.golang.org/genproto/googleapis/rpc v0.0.0-20251202230838-ff82c1b0f217 // indirect
132-
google.golang.org/grpc v1.77.0 // indirect
128+
golang.org/x/tools v0.42.0 // indirect
129+
google.golang.org/api v0.265.0 // indirect
130+
google.golang.org/genproto/googleapis/api v0.0.0-20260128011058-8636f8732409 // indirect
131+
google.golang.org/genproto/googleapis/rpc v0.0.0-20260128011058-8636f8732409 // indirect
132+
google.golang.org/grpc v1.78.0 // indirect
133133
google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.5.1 // indirect
134-
google.golang.org/protobuf v1.36.10 // indirect
134+
google.golang.org/protobuf v1.36.11 // indirect
135135
howett.net/plist v1.0.0 // indirect
136136
)

0 commit comments

Comments
 (0)