docs: [#428] finalize mysql scan documentation and status

- correct mysql counts to 7 HIGH / 1 CRITICAL

- document no-safe-upgrade decision for this pass

- mark mysql rescan/docs subtasks complete

Author: josecelano

docs/issues/428-docker-vulnerability-analysis-apr8-2026.md

@@ -125,8 +125,8 @@ For each image, execute these steps in order:
 - [x] Analysis and triage completed
 - [x] Easy remediation implemented (if available; no safe tag improvement found)
 - [x] Image rebuilt and validated
-- [ ] Trivy re-scan completed and compared
-- [ ] Scan docs updated
+- [x] Trivy re-scan completed and compared
+- [x] Scan docs updated
 - [ ] Follow-up issue created (only if unresolved)
 - [ ] Image marked done
 

docs/security/docker/scans/README.md

@@ -13,7 +13,7 @@ This directory contains historical security scan results for Docker images used
 | `caddy`                                | 2.10.2  | 14   | 4        | ⚠️ Partial remediation    | Apr 8, 2026 | [View](caddy.md)                                |
 | `prom/prometheus`                      | v3.5.1  | 6    | 4        | ⚠️ Partial remediation    | Apr 8, 2026 | [View](prometheus.md)                           |
 | `grafana/grafana`                      | 12.4.2  | 4    | 0        | ⚠️ Partial remediation    | Apr 8, 2026 | [View](grafana.md)                              |
-| `mysql`                                | 8.4     | 8    | 0        | ⚠️ Minor CVE update       | Apr 8, 2026 | [View](mysql.md)                                |
+| `mysql`                                | 8.4     | 7    | 1        | ⚠️ Monitored              | Apr 8, 2026 | [View](mysql.md)                                |
 
 **Overall Status**: ⚠️ **CVE database update detected** - Most images still show increased vulnerability counts from previous scans (Feb-Dec 2025). Deployer has a first remediation pass applied (49 HIGH -> 44 HIGH, with 1 CRITICAL still open).
 

docs/security/docker/scans/mysql.md

@@ -4,12 +4,34 @@ Security scan history for the `mysql` Docker image.
 
 ## Current Status
 
-| Version | HIGH | CRITICAL | Status                 | Last Scan   | Support EOL  |
-| ------- | ---- | -------- | ---------------------- | ----------- | ------------ |
-| 8.4     | 8    | 0        | ⚠️ CVE database update | Apr 8, 2026 | Apr 30, 2032 |
+| Version | HIGH | CRITICAL | Status                         | Last Scan   | Support EOL  |
+| ------- | ---- | -------- | ------------------------------ | ----------- | ------------ |
+| 8.4     | 7    | 1        | ⚠️ Monitored (no safer easy upgrade) | Apr 8, 2026 | Apr 30, 2032 |
 
 ## Scan History
 
+### April 8, 2026 - Remediation Pass 1 (Issue #428)
+
+**Image**: `mysql:8.4`
+**Trivy Version**: 0.68.2
+**Scan Mode**: `--scanners vuln --severity HIGH,CRITICAL`
+**Status**: ⚠️ **8 vulnerabilities** (7 HIGH, 1 CRITICAL)
+
+#### Summary
+
+Findings are concentrated in helper components, not MySQL server core:
+
+- Python packages: 2 HIGH
+- `gosu` Go stdlib dependencies: 5 HIGH, 1 CRITICAL
+
+Tag comparison for easy remediation was performed (`8.4.1`, `8.4.2`, `8.4.3`, `9.0`, `9.1`, `latest`).
+No safer drop-in tag with lower overall risk profile was identified for immediate adoption in this pass.
+
+#### Decision
+
+- Keep `mysql:8.4` for now (validated runtime and LTS alignment)
+- Track unresolved CVEs in follow-up issue for deeper investigation
+
 ### April 8, 2026
 
 **Image**: `mysql:8.4`