From d9b86380da137d072b9c8fb77b84f6fe455e53a7 Mon Sep 17 00:00:00 2001 From: tiffanny29631 Date: Wed, 28 Oct 2026 00:23:15 +0000 Subject: [PATCH] chore: bump git-sync to v4.5.0-gke.6 - git-sync v4.5.0-gke.5 -> v4.5.0-gke.6: rebuild of the same source with the same Go toolchain (go1.26.10), picking up libbrotli1 1.1.0-2+deb13u1. Fixes CVE-2026-111497 (libbrotli1) in the git-sync image. Verified: vuln-gate against v4.5.0-gke.5 shows CVE-2026-111497 fixed and no new findings; govulncheck on /git-sync finds nothing fixable. Container Analysis still reports AUTOVM-CVE-2026-111497, which compares against upstream brotli 1.1.1 and ignores Debian's fix. It is also on v4.5.0-gke.5 and on the nomos and hydration-controller-with-shell images, and no rebuild can clear it. Bug: b/576935996 --- Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Makefile b/Makefile index c726b07305..89ef41a7a9 100644 --- a/Makefile +++ b/Makefile @@ -95,7 +95,7 @@ COSIGN := $(BIN_DIR)/cosign # To automatically update, run this command: # UPDATE_TYPE= make update-git-sync-image -GIT_SYNC_VERSION := v4.5.0-gke.5__linux_amd64 +GIT_SYNC_VERSION := v4.5.0-gke.6__linux_amd64 GIT_SYNC_IMAGE_NAME := gcr.io/config-management-release/git-sync:$(GIT_SYNC_VERSION) # To automatically update, run this command: