From e9ea645caf720cee0e8435ec1d145f5a0898c037 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sat, 15 Aug 2026 18:16:24 +0000
Subject: [PATCH 1/2] Initial plan


From c0e68a0ae431256a639523a166c46aca7f50b59b Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sat, 15 Aug 2026 18:37:24 +0000
Subject: [PATCH 2/2] Add regression test guarding vulnerable squid 0.27.44
 container pin

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
---
 pkg/actionpins/actionpins_internal_test.go | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/pkg/actionpins/actionpins_internal_test.go b/pkg/actionpins/actionpins_internal_test.go
index 88d8739a7c4..16a86628632 100644
--- a/pkg/actionpins/actionpins_internal_test.go
+++ b/pkg/actionpins/actionpins_internal_test.go
@@ -178,6 +178,14 @@ func TestEmbeddedContainerPins_DoNotIncludeVulnerableAWFCliProxy02744(t *testing
 	assert.False(t, ok, "ghcr.io/github/gh-aw-firewall/cli-proxy:0.27.44 should not be embedded as a pinned container image")
 }
 
+func TestEmbeddedContainerPins_DoNotIncludeVulnerableAWFSquid02744(t *testing.T) {
+	t.Parallel()
+
+	_, ok := GetContainerPin("ghcr.io/github/gh-aw-firewall/squid:0.27.44")
+
+	assert.False(t, ok, "ghcr.io/github/gh-aw-firewall/squid:0.27.44 should not be embedded as a pinned container image")
+}
+
 func TestFormatPinnedActionReference_PanicsWhenSHAIsEmpty(t *testing.T) {
 	t.Parallel()
 	assert.PanicsWithValue(t,