From f115d86df5f7c8eca407da4384cca4fdef6b2d55 Mon Sep 17 00:00:00 2001 From: Kevin Veen-Birkenbach Date: Thu, 5 Nov 2026 18:15:18 +0000 Subject: [PATCH] fix(security): drop the image_tag suppressions main's bumps left stale MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Merging main brought in the image bumps of keycloak sso_proxy (v7.15.6), mattermost (12.1.0), nextcloud context_agent (2.11.0) and the three wazuh services (4.14.10). Main carries no suppressions yet, so those bumps skipped the updater's drop_image_tag_entries, and six entries on this branch still named the old tags. test_cve_suppressions rejects every one of them ("does not match its version"). The six blocks are removed exactly as drop_image_tag_entries removes them on a bump: the output of that function on HEAD is identical to the staged files. Scan verdicts do not change, because hlth-runtime matches an image_tag entry only against the running tag (script.py:781) and no deployment runs the old tags any more. A new tag that still ships a fixable CRITICAL is reported by the scan instead of being suppressed unseen. Before: test_cve_suppressions failed with 6 entries. After: it passes, together with the suppression unit tests and all 119 services lints. | 🎯 Fix | 💥 Break | 💸 Cost | ⏱️ Time | 🛡️ Security | 🏆 Score | Gate | | --- | --- | --- | --- | --- | --- | --- | | 97 % | 1 % | – | – | ~100 % | 96 | ⏳ score passes, gate.py not run | Co-Authored-By: Claude Opus 5.5 --- roles/web-app-keycloak/meta/services.yml | 5 ----- roles/web-app-mattermost/meta/services.yml | 5 ----- roles/web-app-nextcloud/meta/services.yml | 5 ----- roles/web-app-wazuh/meta/services.yml | 15 --------------- 4 files changed, 30 deletions(-) diff --git a/roles/web-app-keycloak/meta/services.yml b/roles/web-app-keycloak/meta/services.yml index 3575df6a97..e4ad93e494 100644 --- a/roles/web-app-keycloak/meta/services.yml +++ b/roles/web-app-keycloak/meta/services.yml @@ -101,11 +101,6 @@ sso_proxy: mem_reservation: "64m" mem_limit: "128m" pids_limit: 256 - security: - suppressions: - # nocheck: cve upstream tag ships fixable CRITICAL CVEs; lift it once a rebuilt tag lands - - image_tag: "v7.15.5" - until: 2026-12-03 # nocheck: playwright-service-flag — DB engine, covered by role-local integration tests postgres: bond: 1 diff --git a/roles/web-app-mattermost/meta/services.yml b/roles/web-app-mattermost/meta/services.yml index ee6345d503..00d9e65f1f 100644 --- a/roles/web-app-mattermost/meta/services.yml +++ b/roles/web-app-mattermost/meta/services.yml @@ -65,11 +65,6 @@ mattermost: - web-app-stalwart - web-app-mailu lifecycle: beta - security: - suppressions: - # nocheck: cve upstream tag ships fixable CRITICAL CVEs; lift it once a rebuilt tag lands - - image_tag: "12.0.2" - until: 2026-12-03 # nocheck: dynamic-flag # nocheck: playwright-service-flag — DB engine, covered by role-local integration tests redis: diff --git a/roles/web-app-nextcloud/meta/services.yml b/roles/web-app-nextcloud/meta/services.yml index a152fbb3c8..301e25b982 100644 --- a/roles/web-app-nextcloud/meta/services.yml +++ b/roles/web-app-nextcloud/meta/services.yml @@ -169,11 +169,6 @@ context_agent: path: heartbeat # nocheck: healthcheck-timing-override a sidecar of a stack whose main service alone takes minutes; the value predates this default and has not been measured against it start_period: 20m - security: - suppressions: - # nocheck: cve upstream tag ships fixable CRITICAL CVEs; lift it once a rebuilt tag lands - - image_tag: "2.10.0" - until: 2026-12-03 # nocheck: playwright-service-flag MCP sidecar, no browser surface # nocheck: dynamic-flag the sidecar fronts this role's MCP surface, so it tracks the role's own mcp flag rather than one client's presence contextagentmcp: diff --git a/roles/web-app-wazuh/meta/services.yml b/roles/web-app-wazuh/meta/services.yml index 68fdddbcb1..a3ed60f9e1 100644 --- a/roles/web-app-wazuh/meta/services.yml +++ b/roles/web-app-wazuh/meta/services.yml @@ -84,11 +84,6 @@ manager: agent_events: 1514 agent_registration: 1515 api: 55000 - security: - suppressions: - # nocheck: cve upstream tag ships fixable CRITICAL CVEs; lift it once a rebuilt tag lands - - image_tag: "4.14.9" - until: 2026-12-03 indexer: healthcheck: test: @@ -119,11 +114,6 @@ indexer: http: 9200 local: http: 8097 - security: - suppressions: - # nocheck: cve upstream tag ships fixable CRITICAL CVEs; lift it once a rebuilt tag lands - - image_tag: "4.14.9" - until: 2026-12-03 console: image: wazuh/wazuh-dashboard version: "4.14.10" @@ -139,11 +129,6 @@ console: http: 5601 local: http: 8096 - security: - suppressions: - # nocheck: cve upstream tag ships fixable CRITICAL CVEs; lift it once a rebuilt tag lands - - image_tag: "4.14.9" - until: 2026-12-03 # nocheck: playwright-service-flag # nocheck: variants-coverage — sso-variant-tor requires the onion on in every variant, so the false polarity has no variant left to live in