[WIP] Update grafana/mcp-grafana image to address vulnerabilities

[Copilot]

Thanks for asking me to work on this. I will get started on it and keep this PR's description up to date as I form a plan and make progress.

---

This section details on the original issue you should resolve

<issue_title>[container-image-scan] Container findings for grafana/mcp-grafana</issue_title>
<issue_description>### Summary

Image: grafana/mcp-grafana
Pinned reference: grafana/mcp-grafana@sha256:5efeafd01cd7e1aea9c4b0f03305951f2944db8f43e5ae290cce9578c977f241

• Vulnerabilities: 160 total — Critical: 7, High: 19, Medium: 52, Low: 6, Negligible: 60, Unknown: 16
• License policy violations: 90

Remediation

• Rebuild/update the image to pull in patched packages for the vulnerabilities listed below (fixed versions shown where available).
• Review the licenses listed below against policy; consider replacing, removing, or granting an exception for flagged packages.
• Re-run the scan after remediation to confirm the findings are resolved.

Critical & High severity vulnerabilities

[Critical] CVE-2026-12087: perl-base@5.36.0-7+deb12u3 ((securitytracker.debian.org/redacted)
[Critical] CVE-2026-13221: perl-base@5.36.0-7+deb12u3 ((securitytracker.debian.org/redacted)
[Critical] CVE-2026-42496: perl-base@5.36.0-7+deb12u3 ((securitytracker.debian.org/redacted)
[Critical] CVE-2026-5450: libc-bin@2.36-9+deb12u14 ((securitytracker.debian.org/redacted)
[Critical] CVE-2026-5450: libc6@2.36-9+deb12u14 ((securitytracker.debian.org/redacted)
[Critical] CVE-2026-57433: perl-base@5.36.0-7+deb12u3 ((securitytracker.debian.org/redacted)
[Critical] CVE-2026-8376: perl-base@5.36.0-7+deb12u3 ((securitytracker.debian.org/redacted)
[High] CVE-2025-13151: libtasn1-6@4.19.0-2+deb12u1 ((securitytracker.debian.org/redacted)
[High] CVE-2025-69720: libtinfo6@6.4-4 ((securitytracker.debian.org/redacted)
[High] CVE-2025-69720: ncurses-base@6.4-4 ((securitytracker.debian.org/redacted)
[High] CVE-2025-69720: ncurses-bin@6.4-4 ((securitytracker.debian.org/redacted)
[High] CVE-2026-41992: gzip@1.12-1 ((securitytracker.debian.org/redacted)
[High] CVE-2026-42497: perl-base@5.36.0-7+deb12u3 ((securitytracker.debian.org/redacted)
[High] CVE-2026-48959: perl-base@5.36.0-7+deb12u3 ((securitytracker.debian.org/redacted)
[High] CVE-2026-48962: perl-base@5.36.0-7+deb12u3 ((securitytracker.debian.org/redacted)
[High] CVE-2026-5435: libc-bin@2.36-9+deb12u14 ((securitytracker.debian.org/redacted)
[High] CVE-2026-5435: libc6@2.36-9+deb12u14 ((securitytracker.debian.org/redacted)
[High] CVE-2026-54369: libacl1@2.3.1-3 ((securitytracker.debian.org/redacted)
[High] CVE-2026-54370: libacl1@2.3.1-3 ((securitytracker.debian.org/redacted)
[High] CVE-2026-57432: perl-base@5.36.0-7+deb12u3 ((securitytracker.debian.org/redacted)
[High] CVE-2026-5928: libc-bin@2.36-9+deb12u14 ((securitytracker.debian.org/redacted)
[High] CVE-2026-5928: libc6@2.36-9+deb12u14 ((securitytracker.debian.org/redacted)
[High] CVE-2026-7017: perl-base@5.36.0-7+deb12u3 ((securitytracker.debian.org/redacted)
[High] CVE-2026-9538: perl-base@5.36.0-7+deb12u3 ((securitytracker.debian.org/redacted)
[High] GHSA-hrxh-6v49-42gf: google.golang.org/grpc@v1.80.0 (fix: 1.82.1) (https://github.com/advisories/GHSA-hrxh-6v49-42gf)
[High] GO-2026-5970: golang.org/x/text@v0.37.0 (fix: 0.39.0) (https://go.dev/issue/80142)

Medium / Low / Negligible / Unknown vulnerabilities (134 findings, 134 unique)

[Low] CVE-2016-2781: coreutils@9.1-1 ((securitytracker.debian.org/redacted)
[Low] CVE-2024-56433: login@1:4.13+dfsg1-1+deb12u2 ((securitytracker.debian.org/redacted)
[Low] CVE-2024-56433: passwd@1:4.13+dfsg1-1+deb12u2 ((securitytracker.debian.org/redacted)
[Low] CVE-2026-40228: libsystemd0@252.39-1~deb12u2 ((securitytracker.debian.org/redacted)
[Low] CVE-2026-40228: libudev1@252.39-1~deb12u2 ((securitytracker.debian.org/redacted)
[Low] CVE-2026-57062: gpgv@2.2.40-1.1+deb12u2 ((securitytracker.debian.org/redacted)
[Medium] CVE-2023-50495: libtinfo6@6.4-4 ((securitytracker.debian.org/redacted)
[Medium] CVE-2023-50495: ncurses-base@6.4-4 ((securitytracker.debian.org/redacted)
[Medium] CVE-2023-50495: ncurses-bin@6.4-4 ((securitytracker.debian.org/redacted)
[Medium] CVE-2024-10041: libpam-modules-bin@1.5.2-6+deb12u2 ((securitytracker.debian.org/redacted)
[Medium] CVE-2024-10041: libpam-modules@1.5.2-6+deb12u2 ((securitytracker.debian.org/redacted)
[Medium] CVE-2024-10041: libpam-runtime@1.5.2-6+deb12u2 ((securitytracker.debian.org/redacted)
[Medium] CVE-2024-10041: libpam0g@1.5.2-6+deb12u2 ((securitytracker.debian.org/redacted)
[Medium] CVE-2025-15649: perl-base@5.36.0-7+deb12u3 ((securitytracker.debian.org/redacted)
[Medium] CVE-2025-30258: gpgv@2.2.40-1.1+deb12u2 ((securitytracker.debian.org/redacted)
[Medium] CVE-2025-6141: libtinfo6@6.4-4 ((securitytracker.debian.org/redacted)
[Medium] CVE-2025-6141: ncurses-base@6.4-4 ((securitytracker.debian.org/redacted)
[Medium] CVE-2025-6141: ncurses-bin@6.4-4 ((securitytracker.debian.org/redacted)
[Medium] CVE-2025-68972: gpgv@2.2.40-1.1+deb12u2 ((securitytracker.debian.org/redacted)
[Medium] CVE-2026-13595: bsdutils@1:2.38.1-5+deb12u3 ((securitytracker.debian.org/redacted)
[Medium] CVE-2026-13595: libblkid1@2.38.1-5+deb12u3 ((securitytracker.debian.org/redacted)
[Medium] CVE-2026-13595: libmount1@2.38.1-5+deb12u3 ((securitytracker.debian.org/redacted)
[Medium] CVE-2026-13595: libsmartcols1@2.38.1-5+deb12u3 ((securitytracker.debian.org/redacted)
[Medium] CVE-2026-13595: libuuid1@2.38.1-5+deb12u3 ((securitytracker.debian.org/redacted)
[Medium] CVE-2026-13595: mount@2.38.1-5+deb12u3 ((securitytracker.debian.org/redacted)
[Medium] CVE-2026-13595: util-linux-extra@2.38.1-5+deb12u3 ((securitytracker.debian.org/redacted)
[Medium] CVE-2026-13595: util-linux@2.38.1-5+deb12u3 ((securitytracker.debian.org/redacted)
[Medium] CVE-2026-13757: libp11-kit0@0.24.1-2 ((securitytracker.debian.org/redacted)
[Medium] CVE-2026-27171: zlib1g@1:1.2.13.dfsg-1 ((securitytracker.debian.org/redacted)
[Medium] CVE-2026-27456: bsdutils@1:2.38.1-5+deb12u3 ((securitytracker.debian.org/redacted)
[Medium] CVE-2026-27456: libblkid1@2.38.1-5+deb12u3 ((securitytracker.debian.org/redacted)
[Medium] CVE-2026-27456: libmount1@2.38.1-5+deb12u3 ((securitytracker.debian.org/redacted)
[Medium] CVE-2026-27456: libsmartcols1@2.38.1-5+deb12u3 ((securitytracker.debian.org/redacted)
[Medium] CVE-2026-27456: libuuid1@2.38.1-5+deb12u3 ((securitytracker.debian.org/redacted)
[Medium] CVE-2026-27456: mount@2.38.1-5+deb12u3 ((securitytracker.debian.org/redacted)
[Medium] CVE-2026-27456: util-linux-extra@2.38.1-5+deb12u3 ((securitytracker.debian.org/redacted)
[Medium] CVE-2026-27456: util-linux@2.38.1-5+deb12u3 ((securitytracker.debian.org/redacted)
[Medium] CVE-2026-3184: bsdutils@1:2.38.1-5+deb12u3 ((securitytracker.debian.org/redacted)
[Medium] CVE-2026-3184: libblkid1@2.38.1-5+deb12u3 ((securitytracker.debian.org/redacted)
[Medium] CVE-2026-3184: libmount1@2.38.1-5+deb12u3 ((securitytracker.debian.org/redacted)
[Medium] CVE-2026-3184: libsmartcols1@2.38.1-5+deb12u3 ((securitytracker.debian.org/redacted)
[Medium] CVE-2026-3184: libuuid1@2.38.1-5+deb12u3 ((securitytracker.debian.org/redacted)
[Medium] CVE-2026-3184: mount@2.38.1-5+deb12u3 ((securitytracker.debian.org/redacted)
[Medium] CVE-2026-3184: util-linux-extra@2.38.1-5+deb12u3 ((securitytracker.debian.org/redacted)
[Medium] CVE-2026-3184: util-linux@2.38.1-5+deb12u3 ((securitytracker.debian.org/redacted)
[Medium] CVE-2026-41991: gzip@1.12-1 ((securitytracker.debian.org/redacted)
[Medium] CVE-2026-42250: libbz2-1.0@1.0.8-5+b1 ((securitytracker.debian.org/redacted)
[Medium] CVE-2026-42767: libssl3@3.0.20-1~deb12u2 ((securitytracker.debian.org/redacted)
[Medium] CVE-2026-42767: openssl@3.0.20-1~deb12u2 ((securitytracker.debian.org/redacted)
[Medium] CVE-2026-54371: libattr1@1:2.5.1-4 ((securitytracker.debian.org/redacted)
[Medium] CVE-2026-54411: libpam-modules-bin@1.5.2-6+deb12u2 ((securitytracker.debian.org/redacted)
[Medium] CVE-2026-54411: libpam-modules@1.5.2-6+deb12u2 ((securitytracker.debian.org/redacted)
[Medium] CVE-2026-54411: libpam-runtime@1.5.2-6+deb12u2 ((securitytracker.debian.org/redacted)
[Medium] CVE-2026-54411: libpam0g@1.5.2-6+deb12u2 ((securitytracker.debian.org/redacted)
[Medium] CVE-2026-5704: tar@1.34+dfsg-1.2+deb12u1 ((securitytracker.debian.org/redacted)
[Medium] CVE-2026-6238: libc-bin@2.36-9+deb12u14 ((securitytracker.debian.org/redacted)
[Medium] CVE-2026-6238: libc6@2.36-9+deb12u14 ((securitytracker.debian.org/redacted)
[Medium] CVE-2026-7010: perl-base@5.36.0-7+deb12u3 ((securitytracker.debian.org/redacted)
[Negligible] CVE-2005-2541: tar@1.34+dfsg-1.2+deb12u1 ((securitytracker.debian.org/redacted)
[Negligible] CVE-2007-5686: login@1:4.13+dfsg1-1+deb12u2 ((securitytracker.debian.org/redacted)
[Negligible] CVE-2007-5686: passwd@1:4.13+dfsg1-1+deb12u2 ((securitytracker.debian.org/redacted)
[Negligible] CVE-2010-4756: libc-bin@2.36-9+deb12u14 ((securitytracker.debian.org/redacted)
[Negligible] CVE-2010-4756: libc6@2.36-9+deb12u14 ((securitytracker.debian.org/redacted)
[Negligible] CVE-2011-3374: apt@2.6.1 ((securitytracker.debian.org/redacted)
[Negligible] CVE-2011-3374: libapt-pkg6.0@2.6.1 ((securitytracker.debian.org/redacted)
[Negligible] CVE-2011-3389: libgnutls30@3.7.9-2+deb12u7 ((securitytracker.debian.org/redacted)
[Negligible] CVE-2011-4116: perl-base@5.36.0-7+deb12u3 ((securitytracker.debian.org/redacted)
[Negligible] CVE-2013-4392: libsystemd0@252.39-1~deb12u2 ((securitytracker.debian.org/redacted)
[Negligible] CVE-2013-4392: libudev1@252.39-1~deb12u2 ((securitytracker.debian.org/redacted)
[Negligible] CVE-2017-18018: coreutils@9.1-1 ((securitytracker.debian.org/redacted)
[Negligible] CVE-2018-20796: libc-bin@2.36-9+deb12u14 ((securitytracker.debian.org/redacted)
[Negligible] CVE-2018-20796: libc6@2.36-9+deb12u14 ((securitytracker.debian.org/redacted)
[Negligible] CVE-2018-6829: libgcrypt20@1.10.1-3+deb12u1 ((securitytracker.debian.org/redacted)
[Negligible] CVE-2019-1010022: libc-bin@2.36-9+deb12u14 ((securitytracker.debian.org/redacted)
[Negligible] CVE-2019-1010022: libc6@2.36-9+deb12u14 ((securitytracker.debian.org/redacted)
[Negligible] CVE-2019-1010023: libc-bin@2.36-9+deb12u14 ((securitytracker.debian.org/redacted)
[Negligible] CVE-2019-1010023: libc6@2.36-9+deb12u14 ((securitytracker.debian.org/redacted)
[Negligible] CVE-2019-1010024: libc-bin@2.36-9+deb12u14 ((securitytracker.debian.org/redacted)
[Negligible] CVE-2019-1010024: libc6@2.36-9+deb12u14 ((securitytracker.debian.org/redacted)
[Negligible] CVE-2019-1010025: libc-bin@2.36-9+deb12u14 ((securitytracker.debian.org/redacted)
[Negligible] CVE-2019-1010025: libc6@2.36-9+deb12u14 ((securitytracker.debian.org/redacted)
[Negligible] CVE-2019-9192: libc-bin@2.36-9+deb12u14 ((securitytracker.debian.org/redacted)
[Negligible] CVE-2019-9192: libc6@2.36-9+deb12u14 ((securitytracker.debian.org/redacted)
[Negligible] CVE-2022-0563: bsdutils@1:2.38.1-5+deb12u3 ((securitytracker.debian.org/redacted)
[Negligible] CVE-2022-0563: libblkid1@2.38.1-5+deb12u3 ((securitytracker.debian.org/redacted)
[Negligible] CVE-2022-0563: libmount1@2.38.1-5+deb12u3 ((securitytracker.debian.org/redacted)
[Negligible] CVE-2022-0563: libsmartcols1@2.38.1-5+deb12u3 ((securitytracker.debian.org/redacted)
[Negligible] CVE-2022-0563: libuuid1@2.38.1-5+deb12u3 ((securitytracker.debian.org/redacted)
[Negligible] CVE-2022-0563: mount@2.38.1-5+deb12u3 ((securitytracker.debian.org/redacted)
[Negligible] CVE-2022-0563: util-linux-extra@2.38.1-5+deb12u3 ((securitytracker.debian.org/redacted)
[Negligible] CVE-2022-0563: util-linux@2.38.1-5+deb12u3 ((securitytracker.debian.org/redacted)
[Negligible] CVE-2022-27943: gcc-12-base@12.2.0-14+deb12u1 ((securitytracker.debian.org/redacted)
[Negligible] CVE-2022-27943: libgcc-s1@12.2.0-14+deb12u1 ((securitytracker.debian.org/redacted)
[Negligible] CVE-2022-27943: libstdc++6@12.2.0-14+deb12u1 ((securitytracker.debian.org/redacted)
[Negligible] CVE-2022-3219: gpgv@2.2.40-1.1+deb12u2 ((securitytracker.debian.org/redacted)
[Negligible] CVE-2023-31437: libsystemd0@252.39-1~deb12u2 ((securitytracker.debian.org/redacted)
[Negligible] CVE-2023-31437: libudev1@252.39-1~deb12u2 ((securitytracker.debian.org/redacted)
[Negligible] CVE-2023-31438: libsystemd0@252.39-1~deb12u2 ((securitytracker.debian.org/redacted)
[Negligible] CVE-2023-31438: libudev1@252.39-1~deb12u2 ((securitytracker.debian.org/redacted)
[Negligible] CVE-2023-31439: libsystemd0@252.39-1~deb12u2 ((securitytracker.debian.org/redacted)
[Negligible] CVE-2023-31439: libudev1@252.39-1~deb12u2 ((securitytracker.debian.org/redacted)
[Negligible] CVE-2023-31486: perl-base@5.36.0-7+deb12u3 ((securitytracker.debian.org/redacted)
[Negligible] CVE-2024-2236: libgcrypt20@1.10.1-3+deb12u1 ((securitytracker.debian.org/redacted)
[Negligible] CVE-2025-14104: bsdutils@1:2.38.1-5+deb12u3 ((securitytracker.debian.org/redacted)
[Negligible] CVE-2025-14104: libblkid1@2.38.1-5+deb12u3 ((securitytracker.debian.org/redacted)
[Negligible] CVE-2025-14104: libmount1@2.38.1-5+deb12u3 ((securitytracker.debian.org/redacted)
[Negligible] CVE-2025-14104: libsmartcols1@2.38.1-5+deb12u3 ((securitytracker.debian.org/redacted)
[Negligible] CVE-2025-14104: libuuid1@2.38.1-5+deb12u3 ((securitytracker.debian.org/redacted)
[Negligible] CVE-2025-14104: mount@2.38.1-5+deb12u3 ((securitytracker.debian.org/redacted)
[Negligible] CVE-2025-14104: util-linux-extra@2.38.1-5+deb12u3 ((securitytracker.debian.org/redacted)
[Negligible] CVE-2025-14104: util-linux@2.38.1-5+deb12u3 ((securitytracker.debian.org/redacted)
[Negligible] CVE-2025-27587: libssl3@3.0.20-1~deb12u2 ((securitytracker.debian.org/redacted)
[Negligible] CVE-2025-27587: openssl@3.0.20-1~deb12u2 ((securitytracker.debian.org/redacted)
[Negligible] CVE-2025-5278: coreutils@9.1-1 ((securitytracker.debian.org/redacted)
[Negligible] CVE-2026-48961: perl-base@5.36.0-7+deb12u3 ((securitytracker.debian.org/redacted)
[Negligible] CVE-2026-53910: diffutils@1:3.8-4 ((securitytracker.debian.org/redacted)
[Negligible] CVE-2026-56391: coreutils@9.1-1 ((securitytracker.debian.org/redacted)
[Negligible] CVE-2026-56392: coreutils@9.1-1 ((securitytracker.debian.org/redacted)
[Unknown] CVE-2026-53613: bsdutils@1:2.38.1-5+deb12u3 ((securitytracker.debian.org/redacted)
[Unknown] CVE-2026-53613: libblkid1@2.38.1-5+deb12u3 ((securitytracker.debian.org/redacted)
[Unknown] CVE-2026-53613: libmount1@2.38.1-5+deb12u3 ((securitytracker.debian.org/redacted)
[Unknown] CVE-2026-53613: libsmartcols1@2.38.1-5+deb12u3 ((securitytracker.debian.org/redacted)
[Unknown] CVE-2026-53613: libuuid1@2.38.1-5+deb12u3 ((securitytracker.debian.org/redacted)
[Unknown] CVE-2026-53613: mount@2.38.1-5+deb12u3 ((securitytracker.debian.org/redacted)
[Unknown] CVE-2026-53613: util-linux-extra@2.38.1-5+deb12u3 ((securitytracker.debian.org/redacted)
[Unknown] CVE-2026-53613: util-linux@2.38.1-5+deb12u3 ((securitytracker.debian.org/redacted)
[Unknown] CVE-2026-53615: bsdutils@1:2.38.1-5+deb12u3 ((securitytracker.debian.org/redacted)
[Unknown] CVE-2026-53615: libblkid1@2.38.1-5+deb12u3 ((securitytracker.debian.org/redacted)
[Unknown] CVE-2026-53615: libmount1@2.38.1-5+deb12u3 ((securitytracker.debian.org/redacted)
[Unknown] CVE-2026-53615: libsmartcols1@2.38.1-5+deb12u3 ((securitytracker.debian.org/redacted)
[Unknown] CVE-2026-53615: libuuid1@2.38.1-5+deb12u3 ((securitytracker.debian.org/redacted)
[Unknown] CVE-2026-53615: mount@2.38.1-5+deb12u3 ((securitytracker.debian.org/redacted)
[Unknown] CVE-2026-53615: util-linux-extra@2.38.1-5+deb12u3 ((securitytracker.debian.org/redacted)
[Unknown] CVE-2026-53615: util-linux@2.38.1-5+deb12u3 ((securitytracker.debian.org/redacted)

License policy violations (90 findings, 90 unique)

adduser@3.134 (GPL-2.0-only, GPL-2.0-or-later)
apt@2.6.1 (Expat, GPL-2.0-only, GPL-2.0-or-later)
base-files@12.4+deb12u15 (GPL-2.0-or-later)
base-passwd@3.6.1 (GPL-2.0-only, public-domain)
bash@5.2.15-2+b13 (BSD-4-Clause-UC, GFDL-1.3-only, GFDL-NIV-1.3, GPL-2.0-only, GPL-2.0-or-later, GPL-3.0-only, GPL-3.0-or-later, Latex2e, MIT-like, permissive)
bsdutils@1:2.38.1-5+deb12u3 (BSD-4-Clause, BSLA, GPL-2.0-only, GPL-2.0-or-later, GPL-3.0-only, GPL-3.0-or-later, LGPL, LGPL-2.0-only, LGPL-2.0-or-later, LGPL-2.1-only, LGPL-2.1-or-later, LGPL-3.0-only, LGPL-3.0-or-later, public-domain)
ca-certificates@20230311+deb12u1 (GPL-2.0-only, GPL-2.0-or-later, MPL-2.0)
coreutils@9.1-1 (BSD-4-Clause-UC, FSFULLR, GFDL-1.3-only, GFDL-NIV-1.3, GPL-3.0-only, GPL-3.0-or-later)
dash@0.5.12-2 (GPL-2.0-only, GPL-2.0-or-later, public-domain)
debian-archive-keyring@2023.3+deb12u2 (GPL-2.0-or-later)
debianutils@5.7-0.5~deb12u1 (GPL-2.0-only, GPL-2.0-or-later, SMAIL-GPL, public-domain)
diffutils@1:3.8-4 (FSFAP, FSFULLR, GFDL-1.3-only, GFDL-NIV-1.3, GPL-2.0-only, GPL-2.0-or-later, GPL-3.0-only, GPL-3.0-or-later, LGPL-2.0-only, LGPL-2.0-or-later, LGPL-2.1-only, LGPL-2.1-or-later, LGPL-3.0-only, LGPL-3.0-or-later, X11, public-domain)
dpkg@1.21.23 (GPL-2.0-only, GPL-2.0-or-later, public-domain-s-s-d)
e2fsprogs@1.47.0-2+b2 (GPL, GPL-2.0-only, GPL-2.0-or-later, Kazlib, LGPL-2.0-only, Latex2e)
findutils@4.9.0-4 (FSFAP, FSFULLR, GFDL-1.3-only, GFDL-NIV-1.3+, GPL, GPL-2.0-only, GPL-2.0-or-later, GPL-3.0-only, GPL-3.0-or-later, LGPL-2.0-only, LGPL-2.0-or-later, LGPL-2.1-only, LGPL-2.1-or-later, LGPL-3.0-only, LGPL-3.0-or-later, X11, public-domain)
gcc-12-base@12.2.0-14+deb12u1 (BSD-4-Clause-UC, GPL-2.0-or-later, GPL-3.0-or-later, HPND, LGPL-2.0-or-later, LGPL-2.1-or-later, NCSA, Spencer-94, Unicode-DFS-2015, Zlib)
gpgv@2.2.40-1.1+deb12u2 (CC0-1.0, Expat, GPL-3.0-only, GPL-3.0-or-later, LGPL-2.1-only, LGPL-2.1-or-later, LGPL-3.0-only, LGPL-3.0-or-later, RFC-Reference, TinySCHEME, permissive)
grep@3.8-5 (GPL-3.0-only, GPL-3.0-or-later)
gzip@1.12-1 (FSF-manpages, GFDL-1.3+-no-invariant, GFDL-3, GPL-3.0-only, GPL-3.0-or-later)
hostname@3.23+nmu1 (GPL-2.0-only)
init-system-helpers@1.65.2+deb12u1 (GPL-2.0-only, GPL-2.0-or-later)
libacl1@2.3.1-3 (GPL-2.0-only, GPL-2.0-or-later, LGPL-2.0-or-later, LGPL-2.1-only)
libapt-pkg6.0@2.6.1 (Expat, GPL-2.0-only, GPL-2.0-or-later)
libattr1@1:2.5.1-4 (GPL-2.0-only, GPL-2.0-or-later, LGPL-2.0-or-later, LGPL-2.1-only)
libaudit-common@1:3.0.9-1 (GPL-1.0-only, GPL-2.0-only, LGPL-2.1-only)
libaudit1@1:3.0.9-1 (GPL-1.0-only, GPL-2.0-only, LGPL-2.1-only)
libblkid1@2.38.1-5+deb12u3 (BSD-4-Clause, BSLA, GPL-2.0-only, GPL-2.0-or-later, GPL-3.0-only, GPL-3.0-or-later, LGPL, LGPL-2.0-only, LGPL-2.0-or-later, LGPL-2.1-only, LGPL-2.1-or-later, LGPL-3.0-only, LGPL-3.0-or-later, public-domain)
libbz2-1.0@1.0.8-5+b1 (BSD-variant, GPL-2.0-only)
libc-bin@2.36-9+deb12u14 (GPL-2.0-only, HPND, LGPL-2.1-or-later, Spencer-94)
libc6@2.36-9+deb12u14 (GPL-2.0-only, HPND, LGPL-2.1-or-later, Spencer-94)
libcap-ng0@0.8.3-1+b3 (GPL-2.0-only, GPL-2.0-or-later, GPL-3.0-only, LGPL-2.1-only, LGPL-2.1-or-later)
libcap2@1:2.66-4+deb12u3+b1 (GPL-2.0-only, GPL-2.0-or-later)
libcom-err2@1.47.0-2+b2 (GPL, GPL-2.0-only, GPL-2.0-or-later, Kazlib, LGPL-2.0-only, Latex2e)
libcrypt1@1:4.4.33-2 (no licenses found)
libdb5.3@5.3.28+dfsg2-1 (Artistic, BSD-3-clause-fjord, GPL, GPL-3.0-only, MIT-old, MS-PL, Sleepycat, TCL-like, X11, Zlib)
libdebconfclient0@0.270 (GPL-2.0-only, GPL-2.0-or-later)
libext2fs2@1.47.0-2+b2 (GPL, GPL-2.0-only, GPL-2.0-or-later, Kazlib, LGPL-2.0-only, Latex2e)
libffi8@3.4.4-1 (Expat, GPL, GPL-2.0-or-later, GPL-3.0-or-later, MPL-1.1, X11, public-domain)
libgcc-s1@12.2.0-14+deb12u1 (BSD-4-Clause-UC, GPL-2.0-or-later, GPL-3.0-or-later, HPND, LGPL-2.0-or-later, LGPL-2.1-or-later, NCSA, Spencer-94, Unicode-DFS-2015, Zlib)
libgcrypt20@1.10.1-3+deb12u1 (LGPL-2.1-or-later)
libgmp10@2:6.2.1+dfsg1-1.1 (GPL-2.0-only, GPL-2.0-or-later, GPL-3.0-only, GPL-3.0-or-later, LGPL-3.0-only, LGPL-3.0-or-later)
libgnutls30@3.7.9-2+deb12u7 (CC0-1.0, GPL-3.0-or-later, LGPL-2.1-or-later)
libgpg-error0@1.46-1 (GPL-3.0-only, GPL-3.0-or-later, LGPL-2.1-only, LGPL-2.1-or-later, g10-permissive)
libhogweed6@3.8.1-2 (Expat, GAP, GPL, GPL-2.0-only, GPL-2.0-or-later, GPL-3.0-or-later, LGPL, LGPL-2.0-only, LGPL-2.0-or-later, LGPL-3.0-or-later, public-domain)
libidn2-0@2.3.3-1+b1 (GPL-2.0-only, GPL-2.0-or-later, GPL-3.0-only, GPL-3.0-or-later, LGPL-3.0-only, LGPL-3.0-or-later, Unicode)
liblz4-1@1.9.4-1 (GPL-2.0-only, GPL-2.0-or-later)
liblzma5@5.4.1-1+deb12u1 (Autoconf, GPL-2.0-only, GPL-2.0-or-later, GPL-3.0-only, LGPL-2.0-only, LGPL-2.1-only, LGPL-2.1-or-later, PD, PD-debian, config-h, noderivs, permissive-fsf, permissive-nowarranty, probably-PD)
libmd0@1.0.4-2 (BSD-3-clause-Aaron-D-Gifford, Beerware, public-domain-md4, public-domain-md5, public-domain-sha1)
libmount1@2.38.1-5+deb12u3 (BSD-4-Clause, BSLA, GPL-2.0-only, GPL-2.0-or-later, GPL-3.0-only, GPL-3.0-or-later, LGPL, LGPL-2.0-only, LGPL-2.0-or-later, LGPL-2.1-only, LGPL-2.1-or-later, LGPL-3.0-only, LGPL-3.0-or-later, public-domain)
libnettle8@3.8.1-2 (Expat, GAP, GPL, GPL-2.0-only, GPL-2.0-or-later, GPL-3.0-or-later, LGPL, LGPL-2.0-only, LGPL-2.0-or-later, LGPL-3.0-or-later, public-domain)
libp11-kit0@0.24.1-2 (ISC+IBM, LGPL-2.1-only, LGPL-2.1-or-later, permissive-like-automake-output, same-as-rest-of-p11kit)
libpam-modules-bin@1.5.2-6+deb12u2 (BSD-tcp_wrappers, Beerware, GPL, GPL-2.0-only, GPL-2.0-or-later, GPL-3.0-only, GPL-3.0-or-later, LGPL-2.0-only, LGPL-2.0-or-later, public-domain)
libpam-modules@1.5.2-6+deb12u2 (BSD-tcp_wrappers, Beerware, GPL, GPL-2.0-only, GPL-2.0-or-later, GPL-3.0-only, GPL-3.0-or-later, LGPL-2.0-only, LGPL-2.0-or-later, public-domain)
libpam-runtime@1.5.2-6+deb12u2 (BSD-tcp_wrappers, Beerware, GPL, GPL-2.0-only, GPL-2.0-or-later, GPL-3.0-only, GPL-3.0-or-later, LGPL-2.0-only, LGPL-2.0-or-later, public-domain)
libpam0g@1.5.2-6+deb12u2 (BSD-tcp_wrappers, Beerware, GPL, GPL-2.0-only, GPL-2.0-or-later, GPL-3.0-only, GPL-3.0-or-later, LGPL-2.0-only, LGPL-2.0-or-later, public-domain)
libpcre2-8-0@10.42-1 (BSD-3-clause-Cambridge, X11, public-domain)
libseccomp2@2.5.4-1+deb12u1 (LGPL-2.1-only)
libselinux1@3.4-1+b6 (libselinux-1.0)
libsemanage-common@3.4-1 (LGPL-2.1-or-later)
libsemanage2@3.4-1+b5 (LGPL-2.1-or-later)
libsepol2@3.4-2.1 (GPL-2.0-only, GPL-2.0-or-later, LGPL-2.1-only, LGPL-2.1-or-later, Zlib)
libsmartcols1@2.38.1-5+deb12u3 (BSD-4-Clause, BSLA, GPL-2.0-only, GPL-2.0-or-later, GPL-3.0-only, GPL-3.0-or-later, LGPL, LGPL-2.0-only, LGPL-2.0-or-later, LGPL-2.1-only, LGPL-2.1-or-later, LGPL-3.0-only, LGPL-3.0-or-later, public-domain)
libss2@1.47.0-2+b2 (GPL, GPL-2.0-only, GPL-2.0-or-later, Kazlib, LGPL-2.0-only, Latex2e)
libssl3@3.0.20-1~deb12u2 (Artistic, GPL-1.0-only, GPL-1.0-or-later)
libstdc++6@12.2.0-14+deb12u1 (BSD-4-Clause-UC, GPL-2.0-or-later, GPL-3.0-or-later, HPND, LGPL-2.0-or-later, LGPL-2.1-or-later, NCSA, Spencer-94, Unicode-DFS-2015, Zlib)
libsystemd0@252.39-1~deb12u2 (CC0-1.0, Expat, GPL-2.0-only, GPL-2.0-or-later, LGPL-2.1-only, LGPL-2.1-or-later, public-domain)
libtasn1-6@4.19.0-2+deb12u1 (GPL-3.0-or-later, LGPL-2.1-or-later)
libtinfo6@6.4-4 (MIT/X11, X11)
libudev1@252.39-1~deb12u2 (CC0-1.0, Expat, GPL-2.0-only, GPL-2.0-or-later, LGPL-2.1-only, LGPL-2.1-or-later, public-domain)
libunistring2@1.0-2 (FreeSoftware, GFDL-1.2-only, GFDL-1.2-or-later, GPL-2.0-only, GPL-2.0-or-later, GPL-3.0-only, GPL-3.0-or-later, LGPL-3.0-only, LGPL-3.0-or-later)
libuuid1@2.38.1-5+deb12u3 (BSD-4-Clause, BSLA, GPL-2.0-only, GPL-2.0-or-later, GPL-3.0-only, GPL-3.0-or-later, LGPL, LGPL-2.0-only, LGPL-2.0-or-later, LGPL-2.1-only, LGPL-2.1-or-later, LGPL-3.0-only, LGPL-3.0-or-later, public-domain)
libxxhash0@0.8.1-1 (GPL-2.0-only)
libzstd1@1.5.4+dfsg2-5 (Expat, GPL-2.0-only, Zlib)
login@1:4.13+dfsg1-1+deb12u2 (GPL-1.0-only, GPL-2.0-only, GPL-2.0-or-later, public-domain)
logsave@1.47.0-2+b2 (GPL, GPL-2.0-only, GPL-2.0-or-later, Kazlib, LGPL-2.0-only, Latex2e)
mawk@1.3.4.20200120-3.1 (CC-BY-3.0, GPL-2.0-only, X11)
mount@2.38.1-5+deb12u3 (BSD-4-Clause, BSLA, GPL-2.0-only, GPL-2.0-or-later, GPL-3.0-only, GPL-3.0-or-later, LGPL, LGPL-2.0-only, LGPL-2.0-or-later, LGPL-2.1-only, LGPL-2.1-or-later, LGPL-3.0-only, LGPL-3.0-or-later, public-domain)
ncurses-base@6.4-4 (MIT/X11, X11)
ncurses-bin@6.4-4 (MIT/X11, X11)
openssl@3.0.20-1~deb12u2 (Artistic, GPL-1.0-only, GPL-1.0-or-later)
passwd@1:4.13+dfsg1-1+deb12u2 (GPL-1.0-only, GPL-2.0-only, GPL-2.0-or-later, public-domain)
perl-base@5.36.0-7+deb12u3 (Artistic, Artistic-2.0, Artistic-dist, BSD-3-clause-GENERIC, BSD-3-clause-with-weird-numbering, BSD-4-clause-POWERDOG, BZIP, DONT-CHANGE-THE-GPL, Expat, GPL-1.0-only, GPL-1.0-or-later, GPL-2.0-only, GPL-2.0-or-later, GPL-3+-WITH-BISON-EXCEPTION, HSIEH-BSD, HSIEH-DERIVATIVE, LGPL-2.1-only, REGCOMP, REGCOMP,, RRA-KEEP-THIS-NOTICE, SDBM-PUBLIC-DOMAIN, TEXT-TABS, Unicode, Zlib)
sed@4.9-1+deb12u1 (BSD-4-Clause-UC, BSL-1.0, GFDL-1.3-only, GFDL-NIV-1.3+, GPL-3.0-only, GPL-3.0-or-later, X11, pcre)
sysvinit-utils@3.06-4 (GPL-2.0-only, GPL-2.0-or-later, GPL-3.0-only)
tar@1.34+dfsg-1.2+deb12u1 (GPL-2.0-only, GPL-2.0-or-later, GPL-3.0-only, GPL-3.0-or-later, LGPL-3.0-only, LGPL-3.0-or-later)
tzdata@2026b-0+deb12u1 (public-domain)
usr-is-merged@37~deb12u1 (GPL-2.0-only, GPL-2.0-or-later)
util-linux-extra@2.38.1-5+deb12u3 (BSD-4-Clause, BSLA, GPL-2.0-only, GPL-2.0-or-later, GPL-3.0-only, GPL-3.0-or-later, LGPL, LGPL-2.0-only, LGPL-2.0-or-later, LGPL-2.1-only, LGPL-2.1-or-later, LGPL-3.0-only, LGPL-3.0-or-later, public-domain)
util-linux@2.38.1-5+deb12u3 (BSD-4-Clause, BSLA, GPL-2.0-only, GPL-2.0-or-later, GPL-3.0-only, GPL-3.0-or-later, LGPL, LGPL-2.0-only, LGPL-2.0-or-later, LGPL-2.1-only, LGPL-2.1-or-later, LGPL-3.0-only, LGPL-3.0-or-later, public-domain)
zlib1g@1:1.2.13.dfsg-1 (Zlib)

Generated by 🛡️ Daily Container Image Security Scan · auto · 285.1 AIC · ⌖ 8.51 AIC · ⊞ 6.3K · ◷

• Closes [container-image-scan] Container findings for grafana/mcp-grafana #49511

Comments on the Issue (you are @copilot in this section)

• Fixes [container-image-scan] Container findings for grafana/mcp-grafana #49511