fix: servicemesh-operator2 image CVE on 2026-07-29 - #38
Merged
Conversation
The commit_signoff regex inherited from commit-check defaults requires an ASCII alphanumeric right before the email, so CJK-only author names fail. Relax it to any non-empty name; empty names are still rejected. Signed-off-by: 王然 <ranwang@alauda.io>
oras.land/oras-go/v2 v2.6.0 -> v2.6.1, covers CVE-2026-50151 (HIGH), CVE-2026-50162 (MEDIUM), GHSA-vh4v-2xq2-g5cg (MEDIUM), CVE-2026-48978 (LOW) found by image scan of servicemesh-operator2:2.2.0-r20260729015404. Signed-off-by: 王然 <ranwang@alauda.io>
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
chinaran
added a commit
that referenced
this pull request
Jul 29, 2026
First real execution (PR #38) surfaced four gaps: verify whether the run branch was already merged before asking about a base-branch mismatch; document that commit-check validates only the first commit of a PR and how to recover (rebuild branch, supersede PR) plus a pre-commit signoff regex preflight and a post-PR gh pr checks step; write the regression scan conclusion back into the PR body; correct the pipeline duration estimate. Signed-off-by: 王然 <ranwang@alauda.io>
Superseded by cherry-picking upstream istio-ecosystem#2005 (commit 252db63), which makes the same commit_signoff regex Unicode-aware. Keeping a fork-local variant of the same lines would add merge conflicts on future upstream syncs. This reverts commit f8a6c5f. Signed-off-by: 王然 <ranwang@alauda.io>
…tegy note Fixes an inaccurate note in docs/update-strategy/update-strategy.adoc that claimed only the InPlace strategy is supported in ambient mode. The note conflated the control plane with the data plane, and its stated reason was technically wrong: - The control plane (istiod) supports multiple coexisting revisions in ambient mode. This is already exercised by the e2e test tests/e2e/ambient/ambient_update_test.go (Revision-Based Updates), where istiod and istiod-canary run side by side while sharing a single ztunnel DaemonSet. No validation/webhook ties updateStrategy to ambient (api/v1/istio_types.go only declares the InPlace;RevisionBased enum). - ztunnel is a per-node DaemonSet, not a "cluster-wide singleton with one instance per cluster". Only the ZTunnel custom resource is a singleton (name: default). The real limitation is that ztunnel/CNI are node-shared components that are always updated in place. - The old text also contradicted the same document, which states (line 803) that waypoints "can function with both revisions during migration" under RevisionBased. Additionally, make the commit-check sign-off regex in .commit-check.yml Unicode-aware ([A-Za-z0-9] -> \w) so DCO sign-offs with non-ASCII display names (e.g. Chinese) are accepted. The previous pattern required an ASCII alphanumeric immediately before the email and rejected otherwise-valid sign-offs. Signed-off-by: 王然 <ranwang@alauda.io> (cherry picked from commit 252db63) Signed-off-by: 王然 <ranwang@alauda.io>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
背景
对 Alauda Release run 30415369542 构建的镜像
build-harbor.alauda.cn/asm/servicemesh-operator2:2.2.0-r20260729015404做漏洞扫描，共 6 条漏洞（GO_MODULE=6，GO_STDLIB=0，OS=0），其中 4 条可通过升级依赖修复。修复清单
.commit-check.ymlsignoff 正则 Unicode 化252db639，已于 2026-06-29 合入上游）：[A-Za-z0-9]→\w，纯中文署名（如"王然"）可通过，空名字仍拒绝。附带该 commit 的 update-strategy.adoc 文档修正一并带入验证
go build ./...，构建通过；2.2.0-r20260729052049）构建成功；此前内容完全相同的原分支（fix: servicemesh-operator2 image CVE on 2026-07-29 #37）也经 run 30423972561（2.2.0-r20260729050336）验证过；2.2.0-r20260729052049：上述 4 个 CVE 全部消除，仅剩下表 2 条无修复版本条目。不修复项（无修复版本，如实报告）
镜像基础层无 os 级漏洞，无需处理。
🤖 Generated with Claude Code