Bump golang.org/x/image to v0.42.0 (CVE-2026-33813) - #48345
Conversation
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
Claude Code Review
This repository is configured for manual code reviews. Comment @claude review to trigger a review and subscribe this PR to future pushes, or @claude review once for a one-time review.
Tip: disable this comment in your organization's Code Review settings.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (1)
WalkthroughThe PR updates Go dependency versions, including 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@go.mod`:
- Line 46: The go.mod change unintentionally downgrades
github.com/containerd/containerd from v1.7.33 to v1.7.32, which reintroduces
known HIGH severity vulnerabilities. Revert the containerd version in go.mod
back to v1.7.33 or newer, and then re-run dependency tidying so the module graph
stays aligned; if the lower version is intended, add explicit justification and
risk acceptance in the change discussion.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 861150ce-e652-4ed4-ac5f-90cafcad66f6
⛔ Files ignored due to path filters (1)
go.sumis excluded by!**/*.sum
📒 Files selected for processing (2)
changes/47498-bump-x-image-cve-2026-33813go.mod
There was a problem hiding this comment.
Warning
- Copilot's review of this pull request may be incomplete because some of the changed files are excluded by your Copilot content exclusion settings. See Excluding content from Copilot for details.
Pull request overview
Updates Go module dependencies to remediate CVE-2026-33813 by bumping golang.org/x/image to v0.42.0, along with associated go mod tidy dependency graph updates.
Changes:
- Bump
golang.org/x/imagetov0.42.0(and relatedgolang.org/x/*transitive minimums) ingo.mod/go.sum. - Adjust
github.com/containerd/containerdrequirement tov1.7.32(note: this is a downgrade vs the priorv1.7.33). - Update
go.mod’signorelist by removing./apps.
Reviewed changes
Copilot reviewed 1 out of 3 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| go.mod | Bumps golang.org/x/image and related x/* modules; also changes containerd version and updates the ignore list. |
| go.sum | Updates module checksums to match the new go.mod versions. |
| changes/47498-bump-x-image-cve-2026-33813 | Release-note entry for the dependency/security bump (content excluded by policy). |
Files excluded by content exclusion policy (1)
- changes/47498-bump-x-image-cve-2026-33813
Comments suppressed due to low confidence (1)
go.mod:392
- go.mod also drops
./appsfrom theignorelist. If this was an artifact ofgo mod tidy, consider restoring it (to avoid go tooling traversing non-Go app sources) or at least mentioning the change in the PR summary since it’s unrelated to the x/image CVE bump.
ignore (
./articles
./assets
./docs
./frontend
./handbook
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| github.com/cenkalti/backoff/v4 v4.3.0 | ||
| github.com/clbanning/mxj v1.8.4 | ||
| github.com/containerd/containerd v1.7.33 | ||
| github.com/containerd/containerd v1.7.32 | ||
| github.com/crewjam/saml v0.5.1 |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #48345 +/- ##
==========================================
- Coverage 67.42% 67.41% -0.01%
==========================================
Files 3665 3665
Lines 231969 231969
Branches 12304 12304
==========================================
- Hits 156397 156391 -6
- Misses 61537 61542 +5
- Partials 14035 14036 +1
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
| ) | ||
|
|
||
| ignore ( | ||
| ./apps |
lucasmrod
left a comment
lucasmrod
left a comment
There was a problem hiding this comment.
Seems there are some unrelated changes.
|
Good catch, thanks. The containerd Fixed in 846a481: I reset |
CI Feedback 🧐A test triggered by this PR failed. Here is an AI-generated analysis of the failure:
|
Related issue: N/A (dependency security bump)
Summary
Bumps
golang.org/x/imagefromv0.38.0tov0.42.0to resolve CVE-2026-33813, a denial-of-service (panic) in the WebP decoder when parsing an image with an invalid, large declared size.go mod tidypulled in the transitive minimum-version bumps required byx/image@v0.42.0:x/modv0.35.0→v0.36.0,x/syncv0.20.0→v0.21.0,x/textv0.37.0→v0.38.0,x/toolsv0.44.0→v0.45.0.Exposure assessment
golang.org/x/image/webpdecoder via the org-logo upload path (server/fleet/org_logo.go→image.DecodeConfig).amd64/arm64only, so deployed Fleet was not practically exploitable. The upload also requiresAppConfig:Write(admin) authorization.Checklist for submitter
changes/.Testing
go build ./server/fleet/... ./orbit/pkg/table/app-icons/...passes.go test ./server/fleet/ -run TestValidateOrgLogoBytespasses (covers the WebP/PNG/JPEG/SVG validation path).Summary by CodeRabbit