gh-aw/.grype.yaml at main · github/gh-aw · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
# Grype configuration used by `gh aw compile --grype`.
#
# Ignore rules below are documented risk acceptances for findings that have no
# upstream fix available. Each rule is scoped to a specific vulnerability ID,
# package, and version so other builds remain reported. Remove a rule as soon as
# the upstream base image ships a fix; the daily
# `--force-refresh-container-pins` scan picks the fix up automatically.
ignore:
  # Debian glibc advisories affecting the Debian base layer of
  # ghcr.io/github/github-mcp-server. Debian lists no fixed version for these
  # CVEs, so there is nothing to upgrade to; gh-aw only runs this image as an
  # MCP server and does not redistribute glibc. Re-evaluate when Debian
  # publishes a patched libc6.
  - vulnerability: CVE-2026-5450
    reason: "Debian lists no fixed libc6 version; risk-accepted until a patched base image ships."
    package:
      name: libc6
      version: 2.36-9+deb12u14
      type: deb
  - vulnerability: CVE-2026-5928
    reason: "Debian lists no fixed libc6 version; risk-accepted until a patched base image ships."
    package:
      name: libc6
      version: 2.36-9+deb12u14
      type: deb
  - vulnerability: CVE-2026-5435
    reason: "Debian lists no fixed libc6 version; risk-accepted until a patched base image ships."
    package:
      name: libc6
      version: 2.36-9+deb12u14
      type: deb
  # grafana/mcp-grafana 1.1.0 embeds Go 1.26.5 and module versions with
  # published fixes, but Grafana has not released a rebuilt image containing
  # them. Keep these exceptions scoped to the affected versions so a rebuilt
  # image is scanned normally.
  - vulnerability: GO-2026-5026
    reason: "No fixed grafana/mcp-grafana image is available; risk-accepted until Grafana rebuilds with Go 1.26.6 or newer."
    package:
      name: stdlib
      version: go1.26.5
      type: go-module
  - vulnerability: GO-2026-5942
    reason: "No fixed grafana/mcp-grafana image is available; risk-accepted until Grafana rebuilds with Go 1.26.6 or newer."
    package:
      name: stdlib
      version: go1.26.5
      type: go-module
  - vulnerability: GO-2026-5972
    reason: "No fixed grafana/mcp-grafana image is available; risk-accepted until Grafana rebuilds with Go 1.26.6 or newer."
    package:
      name: stdlib
      version: go1.26.5
      type: go-module
  - vulnerability: GO-2026-6088
    reason: "No fixed grafana/mcp-grafana image is available; risk-accepted until Grafana rebuilds with Go 1.26.6 or newer."
    package:
      name: stdlib
      version: go1.26.5
      type: go-module
  - vulnerability: GO-2026-6089
    reason: "No fixed grafana/mcp-grafana image is available; risk-accepted until Grafana rebuilds with Go 1.26.6 or newer."
    package:
      name: stdlib
      version: go1.26.5
      type: go-module
  - vulnerability: GO-2026-6090
    reason: "No fixed grafana/mcp-grafana image is available; risk-accepted until Grafana rebuilds with Go 1.26.6 or newer."
    package:
      name: stdlib
      version: go1.26.5
      type: go-module
  - vulnerability: GO-2026-6091
    reason: "No fixed grafana/mcp-grafana image is available; risk-accepted until Grafana rebuilds with Go 1.26.6 or newer."
    package:
      name: stdlib
      version: go1.26.5
      type: go-module
  - vulnerability: GO-2026-6218
    reason: "No fixed grafana/mcp-grafana image is available; risk-accepted until Grafana rebuilds with Go 1.26.6 or newer."
    package:
      name: stdlib
      version: go1.26.5
      type: go-module
  - vulnerability: GO-2026-5970
    reason: "No fixed grafana/mcp-grafana image is available; risk-accepted until Grafana rebuilds with golang.org/x/text 0.39.0 or newer."
    package:
      name: golang.org/x/text
      version: v0.37.0
      type: go-module
  - vulnerability: GHSA-hrxh-6v49-42gf
    reason: "No fixed grafana/mcp-grafana image is available; risk-accepted until Grafana rebuilds with google.golang.org/grpc 1.82.1 or newer."
    package:
      name: google.golang.org/grpc
      version: v1.80.0
      type: go-module
  # Alpine has not published a fixed busybox package for CVE-2025-60876.
  - vulnerability: CVE-2025-60876
    reason: "Alpine lists no fixed busybox version; risk-accepted until a patched grafana/mcp-grafana base image ships."
    package:
      name: busybox
      version: 1.37.0-r30
      type: apk
  - vulnerability: CVE-2025-60876
    reason: "Alpine lists no fixed busybox-binsh version; risk-accepted until a patched grafana/mcp-grafana base image ships."
    package:
      name: busybox-binsh
      version: 1.37.0-r30
      type: apk
  - vulnerability: CVE-2025-60876
    reason: "Alpine lists no fixed ssl_client version; risk-accepted until a patched grafana/mcp-grafana base image ships."
    package:
      name: ssl_client
      version: 1.37.0-r30
      type: apk