Update third party libraries flagged for vulnerability scans#1124
Merged
collin-lee merged 1 commit intoenvoyproxy:mainfrom Apr 30, 2026
Merged
Conversation
Signed-off-by: collin-lee <collin.lee@salesforce.com>
collin-lee
approved these changes
Apr 30, 2026
harrisonharris-di
pushed a commit
to harrisonharris-di/ratelimit
that referenced
this pull request
May 4, 2026
PR envoyproxy#1124 updated the golang base image from 1.26.1 to 1.26.2, but the new digest sha256:7095ad02810845fa35d1fb090b8e57dd20dce4ca36b29b42951 802350d2ec90e is a single-arch (linux/amd64) image manifest rather than a multi-arch index. The previous 1.26.1 digest sha256:e2ddb153f7 86ee6210bf8c40f7f35490b3ff7d38be70d1a0d358ba64225f6428 is an OCI image index covering linux/amd64, arm64/v8, arm/v7, 386, ppc64le, riscv64, s390x and windows/amd64. When buildx is asked to produce a non-amd64 variant of the published envoyproxy/ratelimit image, the FROM line resolves to the amd64 base on every platform, so the resulting binary is amd64 regardless of the target. The multi-arch publish then stamps that amd64 binary into the arm64 layer of the released index, producing an image that fails on arm64 nodes with: exec /bin/ratelimit: exec format error Swap to the corresponding multi-arch index digest sha256:b54cbf583d39 0341599d7bcbc062425c081105cc5ef6d170ced98ef9d047c716, which contains the existing 7095ad02... amd64 manifest as one of its children plus the arm64/v8 and other platform variants. The amd64 image is unchanged; arm64 builds now produce arm64 binaries. Signed-off-by: Harrison Harris <harrison.harris@xapien.com>
psbrar99
pushed a commit
that referenced
this pull request
May 7, 2026
PR #1124 updated the golang base image from 1.26.1 to 1.26.2, but the new digest sha256:7095ad02810845fa35d1fb090b8e57dd20dce4ca36b29b42951 802350d2ec90e is a single-arch (linux/amd64) image manifest rather than a multi-arch index. The previous 1.26.1 digest sha256:e2ddb153f7 86ee6210bf8c40f7f35490b3ff7d38be70d1a0d358ba64225f6428 is an OCI image index covering linux/amd64, arm64/v8, arm/v7, 386, ppc64le, riscv64, s390x and windows/amd64. When buildx is asked to produce a non-amd64 variant of the published envoyproxy/ratelimit image, the FROM line resolves to the amd64 base on every platform, so the resulting binary is amd64 regardless of the target. The multi-arch publish then stamps that amd64 binary into the arm64 layer of the released index, producing an image that fails on arm64 nodes with: exec /bin/ratelimit: exec format error Swap to the corresponding multi-arch index digest sha256:b54cbf583d39 0341599d7bcbc062425c081105cc5ef6d170ced98ef9d047c716, which contains the existing 7095ad02... amd64 manifest as one of its children plus the arm64/v8 and other platform variants. The amd64 image is unchanged; arm64 builds now produce arm64 binaries. Signed-off-by: Harrison Harris <harrison.harris@xapien.com> Co-authored-by: Harrison Harris <harrison.harris@xapien.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Updates third-party libraries to address security vulnerabilities identified in the CDP policy engine security scan for
`sfci/3pp/3pp/docker.io/envoyproxy/ratelimit`.
Changes
Go Dependencies (go.mod)
Docker Images
CI/CD