bvandeusen/minstrel
1
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases 52 Wiki Activity

Security Dashboard #125

New Issue
Open
opened 2026-08-09 20:59:10 -04:00 by renovate-bot · 0 comments
renovate-bot commented 2026-08-09 20:59:10 -04:00
Collaborator
Copy Link
Copy Source

Automated weekly security sweep — last rewritten 2026-10-19 07:32 UTC (runs).

This issue is maintained like the Renovate Dependency Dashboard: every sweep run rewrites it in place. Don't edit findings here — fix them, or allowlist them with a written reason (this repo's .gitleaks.toml for secrets, an inline # nosemgrep: <rule-id> -- <reason> for code findings). There is no per-push security lane; this dashboard and the on-demand deep review are where security findings surface.

Secrets (gitleaks)

  • internal/api/auth_register_test.go:99 — rule generic-api-key, commit a4493989 2026-05-07T15:56:19Z

Code findings (semgrep, curated family ruleset)

Clean — no findings.

Dependency CVEs (osv-scanner)

Published image (trivy)

  • HIGH CVE-2026-53613 — bsdutils 1:2.38.1-5+deb12u3 (no fix released)
  • HIGH CVE-2026-53615 — bsdutils 1:2.38.1-5+deb12u3 (no fix released)
  • HIGH CVE-2026-76642 — bsdutils 1:2.38.1-5+deb12u3 (no fix released)
  • HIGH CVE-2026-78408 — bsdutils 1:2.38.1-5+deb12u3 (no fix released)
  • HIGH CVE-2026-78409 — bsdutils 1:2.38.1-5+deb12u3 (no fix released)
  • HIGH CVE-2026-78410 — bsdutils 1:2.38.1-5+deb12u3 (no fix released)
  • HIGH CVE-2026-52296 — ffmpeg 7:5.1.9-0+deb12u1 (no fix released)
  • HIGH CVE-2026-52297 — ffmpeg 7:5.1.9-0+deb12u1 (no fix released)
  • HIGH CVE-2026-58049 — ffmpeg 7:5.1.9-0+deb12u1 (no fix released)
  • HIGH CVE-2026-64830 — ffmpeg 7:5.1.9-0+deb12u1 (no fix released)
  • HIGH CVE-2026-64832 — ffmpeg 7:5.1.9-0+deb12u1 (no fix released)
  • HIGH CVE-2026-64833 — ffmpeg 7:5.1.9-0+deb12u1 (no fix released)
  • HIGH CVE-2026-64834 — ffmpeg 7:5.1.9-0+deb12u1 (no fix released)
  • HIGH CVE-2026-64835 — ffmpeg 7:5.1.9-0+deb12u1 (no fix released)
  • HIGH CVE-2026-66036 — ffmpeg 7:5.1.9-0+deb12u1 (no fix released)
  • HIGH CVE-2026-66039 — ffmpeg 7:5.1.9-0+deb12u1 (no fix released)
  • HIGH CVE-2026-66040 — ffmpeg 7:5.1.9-0+deb12u1 (no fix released)
  • HIGH CVE-2026-70628 — ffmpeg 7:5.1.9-0+deb12u1 (no fix released)
  • HIGH CVE-2026-70632 — ffmpeg 7:5.1.9-0+deb12u1 (no fix released)
  • HIGH CVE-2026-75142 — ffmpeg 7:5.1.9-0+deb12u1 (no fix released)
  • HIGH CVE-2026-75143 — ffmpeg 7:5.1.9-0+deb12u1 (no fix released)
  • HIGH CVE-2026-75144 — ffmpeg 7:5.1.9-0+deb12u1 (no fix released)
  • HIGH CVE-2026-75146 — ffmpeg 7:5.1.9-0+deb12u1 (no fix released)
  • HIGH CVE-2026-8461 — ffmpeg 7:5.1.9-0+deb12u1 (no fix released)
  • HIGH CVE-2026-96611 — ffmpeg 7:5.1.9-0+deb12u1 (no fix released)
  • HIGH CVE-2026-41992 — gzip 1.12-1 (no fix released)
  • HIGH CVE-2026-54369 — libacl1 2.3.1-3 (no fix released)
  • CRITICAL CVE-2023-6879 — libaom3 3.6.0-1+deb12u3 (no fix released)
  • HIGH CVE-2023-39616 — libaom3 3.6.0-1+deb12u3 (no fix released)
  • HIGH CVE-2026-52296 — libavcodec59 7:5.1.9-0+deb12u1 (no fix released)
  • HIGH CVE-2026-52297 — libavcodec59 7:5.1.9-0+deb12u1 (no fix released)
  • HIGH CVE-2026-58049 — libavcodec59 7:5.1.9-0+deb12u1 (no fix released)
  • HIGH CVE-2026-64830 — libavcodec59 7:5.1.9-0+deb12u1 (no fix released)
  • HIGH CVE-2026-64832 — libavcodec59 7:5.1.9-0+deb12u1 (no fix released)
  • HIGH CVE-2026-64833 — libavcodec59 7:5.1.9-0+deb12u1 (no fix released)
  • HIGH CVE-2026-64834 — libavcodec59 7:5.1.9-0+deb12u1 (no fix released)
  • HIGH CVE-2026-64835 — libavcodec59 7:5.1.9-0+deb12u1 (no fix released)
  • HIGH CVE-2026-66036 — libavcodec59 7:5.1.9-0+deb12u1 (no fix released)
  • HIGH CVE-2026-66039 — libavcodec59 7:5.1.9-0+deb12u1 (no fix released)
  • HIGH CVE-2026-66040 — libavcodec59 7:5.1.9-0+deb12u1 (no fix released)
    …and 256 more line(s) truncated — run the scanner locally or trigger the sweep with only= for the full list.

Coverage & limits

  • All four scanners ran with nothing skipped.
<!-- fabledsentry-security-dashboard --> _Automated weekly security sweep — last rewritten 2026-10-19 07:32 UTC ([runs](https://git.fabledsword.com/bvandeusen/CI-runner/actions))._ This issue is maintained like the Renovate Dependency Dashboard: every sweep run rewrites it in place. Don't edit findings here — fix them, or allowlist them **with a written reason** (this repo's `.gitleaks.toml` for secrets, an inline `# nosemgrep: <rule-id> -- <reason>` for code findings). There is no per-push security lane; this dashboard and the on-demand deep review are where security findings surface. ## Secrets (gitleaks) - `internal/api/auth_register_test.go:99` — rule `generic-api-key`, commit `a4493989` 2026-05-07T15:56:19Z ## Code findings (semgrep, curated family ruleset) Clean — no findings. ## Dependency CVEs (osv-scanner) - `github.com/go-chi/chi/v5 5.2.5` (Go, `go.mod`): [GO-2026-5774](https://osv.dev/vulnerability/GO-2026-5774), [GO-2026-5775](https://osv.dev/vulnerability/GO-2026-5775), [GO-2026-5777](https://osv.dev/vulnerability/GO-2026-5777) - `golang.org/x/crypto 0.51.0` (Go, `go.mod`): [GHSA-45gg-vh54-h5m9](https://osv.dev/vulnerability/GHSA-45gg-vh54-h5m9), [GHSA-5cgq-3rg8-m6cv](https://osv.dev/vulnerability/GHSA-5cgq-3rg8-m6cv), [GHSA-78mq-xcr3-xm33](https://osv.dev/vulnerability/GHSA-78mq-xcr3-xm33), [GHSA-89gr-r52h-f8rx](https://osv.dev/vulnerability/GHSA-89gr-r52h-f8rx), [GHSA-9m57-25v3-79x9](https://osv.dev/vulnerability/GHSA-9m57-25v3-79x9), [GHSA-f5wc-c3c7-36mc](https://osv.dev/vulnerability/GHSA-f5wc-c3c7-36mc), [GHSA-jppx-rxg9-jmrx](https://osv.dev/vulnerability/GHSA-jppx-rxg9-jmrx), [GHSA-q4h4-gmj2-qvw2](https://osv.dev/vulnerability/GHSA-q4h4-gmj2-qvw2), [GHSA-qpw4-5x99-6vjp](https://osv.dev/vulnerability/GHSA-qpw4-5x99-6vjp), [GHSA-rm3j-f69w-wqmq](https://osv.dev/vulnerability/GHSA-rm3j-f69w-wqmq), [GHSA-vgwf-h737-ff37](https://osv.dev/vulnerability/GHSA-vgwf-h737-ff37), [GHSA-w879-237q-wc7r](https://osv.dev/vulnerability/GHSA-w879-237q-wc7r), [GHSA-x527-x647-q7gg](https://osv.dev/vulnerability/GHSA-x527-x647-q7gg), [GO-2026-5005](https://osv.dev/vulnerability/GO-2026-5005), [GO-2026-5006](https://osv.dev/vulnerability/GO-2026-5006), [GO-2026-5013](https://osv.dev/vulnerability/GO-2026-5013), [GO-2026-5014](https://osv.dev/vulnerability/GO-2026-5014), [GO-2026-5015](https://osv.dev/vulnerability/GO-2026-5015), [GO-2026-5016](https://osv.dev/vulnerability/GO-2026-5016), [GO-2026-5017](https://osv.dev/vulnerability/GO-2026-5017), [GO-2026-5018](https://osv.dev/vulnerability/GO-2026-5018), [GO-2026-5019](https://osv.dev/vulnerability/GO-2026-5019), [GO-2026-5020](https://osv.dev/vulnerability/GO-2026-5020), [GO-2026-5021](https://osv.dev/vulnerability/GO-2026-5021), [GO-2026-5023](https://osv.dev/vulnerability/GO-2026-5023), [GO-2026-5033](https://osv.dev/vulnerability/GO-2026-5033), [GO-2026-5932](https://osv.dev/vulnerability/GO-2026-5932), [GO-2026-6303](https://osv.dev/vulnerability/GO-2026-6303), [GO-2026-6354](https://osv.dev/vulnerability/GO-2026-6354), [GO-2026-6355](https://osv.dev/vulnerability/GO-2026-6355) - `sharp 0.34.5` (npm, `tools/package-lock.json`): [GHSA-f88m-g3jw-g9cj](https://osv.dev/vulnerability/GHSA-f88m-g3jw-g9cj), [GHSA-rgj7-g3m4-5g8c](https://osv.dev/vulnerability/GHSA-rgj7-g3m4-5g8c), [GHSA-wq5f-xc86-pv6w](https://osv.dev/vulnerability/GHSA-wq5f-xc86-pv6w) ## Published image (trivy) - **HIGH** CVE-2026-53613 — `bsdutils 1:2.38.1-5+deb12u3` (no fix released) - **HIGH** CVE-2026-53615 — `bsdutils 1:2.38.1-5+deb12u3` (no fix released) - **HIGH** CVE-2026-76642 — `bsdutils 1:2.38.1-5+deb12u3` (no fix released) - **HIGH** CVE-2026-78408 — `bsdutils 1:2.38.1-5+deb12u3` (no fix released) - **HIGH** CVE-2026-78409 — `bsdutils 1:2.38.1-5+deb12u3` (no fix released) - **HIGH** CVE-2026-78410 — `bsdutils 1:2.38.1-5+deb12u3` (no fix released) - **HIGH** CVE-2026-52296 — `ffmpeg 7:5.1.9-0+deb12u1` (no fix released) - **HIGH** CVE-2026-52297 — `ffmpeg 7:5.1.9-0+deb12u1` (no fix released) - **HIGH** CVE-2026-58049 — `ffmpeg 7:5.1.9-0+deb12u1` (no fix released) - **HIGH** CVE-2026-64830 — `ffmpeg 7:5.1.9-0+deb12u1` (no fix released) - **HIGH** CVE-2026-64832 — `ffmpeg 7:5.1.9-0+deb12u1` (no fix released) - **HIGH** CVE-2026-64833 — `ffmpeg 7:5.1.9-0+deb12u1` (no fix released) - **HIGH** CVE-2026-64834 — `ffmpeg 7:5.1.9-0+deb12u1` (no fix released) - **HIGH** CVE-2026-64835 — `ffmpeg 7:5.1.9-0+deb12u1` (no fix released) - **HIGH** CVE-2026-66036 — `ffmpeg 7:5.1.9-0+deb12u1` (no fix released) - **HIGH** CVE-2026-66039 — `ffmpeg 7:5.1.9-0+deb12u1` (no fix released) - **HIGH** CVE-2026-66040 — `ffmpeg 7:5.1.9-0+deb12u1` (no fix released) - **HIGH** CVE-2026-70628 — `ffmpeg 7:5.1.9-0+deb12u1` (no fix released) - **HIGH** CVE-2026-70632 — `ffmpeg 7:5.1.9-0+deb12u1` (no fix released) - **HIGH** CVE-2026-75142 — `ffmpeg 7:5.1.9-0+deb12u1` (no fix released) - **HIGH** CVE-2026-75143 — `ffmpeg 7:5.1.9-0+deb12u1` (no fix released) - **HIGH** CVE-2026-75144 — `ffmpeg 7:5.1.9-0+deb12u1` (no fix released) - **HIGH** CVE-2026-75146 — `ffmpeg 7:5.1.9-0+deb12u1` (no fix released) - **HIGH** CVE-2026-8461 — `ffmpeg 7:5.1.9-0+deb12u1` (no fix released) - **HIGH** CVE-2026-96611 — `ffmpeg 7:5.1.9-0+deb12u1` (no fix released) - **HIGH** CVE-2026-41992 — `gzip 1.12-1` (no fix released) - **HIGH** CVE-2026-54369 — `libacl1 2.3.1-3` (no fix released) - **CRITICAL** CVE-2023-6879 — `libaom3 3.6.0-1+deb12u3` (no fix released) - **HIGH** CVE-2023-39616 — `libaom3 3.6.0-1+deb12u3` (no fix released) - **HIGH** CVE-2026-52296 — `libavcodec59 7:5.1.9-0+deb12u1` (no fix released) - **HIGH** CVE-2026-52297 — `libavcodec59 7:5.1.9-0+deb12u1` (no fix released) - **HIGH** CVE-2026-58049 — `libavcodec59 7:5.1.9-0+deb12u1` (no fix released) - **HIGH** CVE-2026-64830 — `libavcodec59 7:5.1.9-0+deb12u1` (no fix released) - **HIGH** CVE-2026-64832 — `libavcodec59 7:5.1.9-0+deb12u1` (no fix released) - **HIGH** CVE-2026-64833 — `libavcodec59 7:5.1.9-0+deb12u1` (no fix released) - **HIGH** CVE-2026-64834 — `libavcodec59 7:5.1.9-0+deb12u1` (no fix released) - **HIGH** CVE-2026-64835 — `libavcodec59 7:5.1.9-0+deb12u1` (no fix released) - **HIGH** CVE-2026-66036 — `libavcodec59 7:5.1.9-0+deb12u1` (no fix released) - **HIGH** CVE-2026-66039 — `libavcodec59 7:5.1.9-0+deb12u1` (no fix released) - **HIGH** CVE-2026-66040 — `libavcodec59 7:5.1.9-0+deb12u1` (no fix released) _…and 256 more line(s) truncated — run the scanner locally or trigger the sweep with `only=` for the full list._ ## Coverage & limits - All four scanners ran with nothing skipped.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
deps
Dependency update (Renovate)
 deps:major
Major dependency bump — held for manual review
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
renovate-bot bvandeusen
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: bvandeusen/minstrel#125