Summary
- Image:
ghcr.io/github/gh-aw-mcpg:v0.4.8
- Pinned reference:
ghcr.io/github/gh-aw-mcpg:v0.4.8@sha256:38bbea36cdb46a3c9d04d1db05e672966f5239b431a2022eb35881688e5721d8
- Vulnerabilities: 6 total (0 Critical, 6 High)
- License violations: 59
Vulnerabilities
6 vulnerabilities (click to expand)
Licenses
59 license policy violations (click to expand)
- ca-certificates-bundle@20260611-r0 (MPL-2.0)
- libgcc@15.2.0-r5 (LGPL-2.1-or-later, GPL-2.0-or-later)
- libsasl@2.1.28-r9 (BSD-3-Clause-Attribution, BSD-4-Clause)
- libldap@2.6.13-r0 (OLDAP-2.8)
- libncursesw@6.6_p20260516-r0 (X11)
- zlib@1.3.2-r0 (Zlib)
- libgcrypt@1.12.2-r0 (GPL-2.0-or-later, LGPL-2.1-or-later)
- libgpg-error@1.61-r0 (GPL-2.0-or-later, LGPL-2.1-or-later)
- passt@2026.05.26-r0 (GPL-2.0-or-later)
- glib@2.88.1-r1 (LGPL-2.1-or-later)
- libmount@2.42.1-r0 (LGPL-2.1-or-later)
- libcap2@2.78-r0 (GPL-2.0-only)
- alpine-baselayout@3.7.2-r1 (GPL-2.0-only)
- ca-certificates@20260611-r0 (MPL-2.0)
- gnupg-gpgconf@2.4.9-r1 (GPL-3.0-or-later)
- gpgsm@2.4.9-r1 (GPL-3.0-or-later)
- libunistring@1.4.2-r0 (GPL-2.0-or-later, LGPL-3.0-or-later)
- zstd-libs@1.5.7-r2 (GPL-2.0-or-later)
- libmnl@1.0.5-r2 (LGPL-2.1-or-later)
- alpine-baselayout-data@3.7.2-r1 (GPL-2.0-only)
- gnupg-keyboxd@2.4.9-r1 (GPL-3.0-or-later)
- libidn2@2.3.8-r0 (GPL-2.0-or-later, LGPL-3.0-or-later)
- musl-utils@1.2.6-r2 (GPL-2.0-or-later)
- libtasn1@4.21.0-r0 (LGPL-2.1-or-later)
- libnftnl@1.3.1-r0 (GPL-2.0-or-later)
- fuse3@3.18.2-r0 (GPL-2.0-only, LGPL-2.1-only)
- libbz2@1.0.8-r6 (bzip2-1.0.6)
- libapk@3.0.6-r0 (GPL-2.0-only)
- gdbm@1.26-r0 (GPL-3.0-or-later)
- crun@1.28-r0 (GPL-2.0-or-later, LGPL-2.1-or-later)
- pinentry@1.3.2-r0 (GPL-2.0-or-later)
- libblkid@2.42.1-r0 (LGPL-2.1-or-later)
- gnupg-dirmngr@2.4.9-r1 (GPL-3.0-or-later)
- gpg@2.4.9-r1 (GPL-3.0-or-later)
- gpg-agent@2.4.9-r1 (GPL-3.0-or-later)
- scanelf@1.3.9-r1 (GPL-2.0-only)
- busybox-binsh@1.37.0-r31 (GPL-2.0-only)
- ssl_client@1.37.0-r31 (GPL-2.0-only)
- bash@5.3.9-r1 (GPL-3.0-or-later)
- gnutls@3.8.13-r0 (LGPL-2.1-or-later)
- libassuan@3.0.2-r0 (LGPL-2.1-or-later)
- apk-tools@3.0.6-r0 (GPL-2.0-only)
- nftables@1.1.6-r1 (GPL-2.0-or-later)
- gpgme@2.0.1-r1 (LGPL-2.1-or-later, GPL-3.0-or-later)
- readline@8.3.3-r1 (GPL-3.0-or-later)
- gmp@6.3.0-r4 (GPL-2.0-or-later, LGPL-3.0-or-later)
- fuse-common@3.18.2-r0 (GPL-2.0-only, LGPL-2.1-only)
- sqlite-libs@3.53.2-r0 (blessing)
- fuse3-libs@3.18.2-r0 (GPL-2.0-only, LGPL-2.1-only)
- libksba@1.7.0-r0 (GPL-3.0-only, LGPL-3.0-only, GPL-2.0-only)
- npth@1.8-r0 (LGPL-2.0-or-later)
- catatonit@0.2.1-r0 (GPL-2.0-or-later)
- fuse-overlayfs@1.16-r0 (GPL-2.0-or-later)
- nettle@3.10.2-r0 (GPL-2.0-or-later, LGPL-3.0-or-later)
- libintl@1.0-r0 (LGPL-2.1-or-later)
- libseccomp@2.6.0-r2 (LGPL-2.1-or-later)
- libmd@1.2.0-r0 (AND, Beerware, Domain, Public)
- ncurses-terminfo-base@6.6_p20260516-r0 (X11)
- busybox@1.37.0-r31 (GPL-2.0-only)
Remediation
- Rebuild with Go 1.25.12/1.26.5+ to fix GO-2026-5037 and GO-2026-4970.
- Bump golang.org/x/text to 0.39.0+ to resolve GO-2026-5970.
- Bump github.com/sigstore/fulcio to 1.8.6+ to resolve GHSA-f5mr-q85p-6hh6.
- Bump google.golang.org/grpc to 1.82.1+ to resolve GHSA-hrxh-6v49-42gf.
- Review flagged GPL/LGPL Alpine and gnupg-related license violations against project policy.
Generated by 🛡️ Daily Container Image Security Scan · auto · 445.4 AIC · ⌖ 18.1 AIC · ⊞ 6.5K · ◷
Summary
ghcr.io/github/gh-aw-mcpg:v0.4.8ghcr.io/github/gh-aw-mcpg:v0.4.8@sha256:38bbea36cdb46a3c9d04d1db05e672966f5239b431a2022eb35881688e5721d8Vulnerabilities
6 vulnerabilities (click to expand)
Licenses
59 license policy violations (click to expand)
Remediation