Skip to content

fix: Trivy スキャンで検出された CVE-2025-68121 に対応 #461

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
keito4 merged 1 commit into from
Feb 12, 2026
Merged

fix: Trivy スキャンで検出された CVE-2025-68121 に対応 #461

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 6 additions & 6 deletions .devcontainer/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
FROM mcr.microsoft.com/devcontainers/base:ubuntu

# Build arguments for Claude Code authentication
ARG CLAUDE_CODE_OAUTH_TOKEN

Check warning on line 4 in .devcontainer/Dockerfile

View workflow job for this annotation

GitHub Actions / Generate SBOM

Sensitive data should not be used in the ARG or ENV commands 

SecretsUsedInArgOrEnv: Do not use ARG or ENV instructions for sensitive data (ARG "CLAUDE_CODE_OAUTH_TOKEN")
More info: https://docs.docker.com/go/dockerfile/rule/secrets-used-in-arg-or-env/

Check warning on line 4 in .devcontainer/Dockerfile

View workflow job for this annotation

GitHub Actions / Trivy Container Scan

Sensitive data should not be used in the ARG or ENV commands 

SecretsUsedInArgOrEnv: Do not use ARG or ENV instructions for sensitive data (ARG "CLAUDE_CODE_OAUTH_TOKEN")
More info: https://docs.docker.com/go/dockerfile/rule/secrets-used-in-arg-or-env/
ARG ANTHROPIC_API_KEY

Check warning on line 5 in .devcontainer/Dockerfile

View workflow job for this annotation

GitHub Actions / Generate SBOM

Sensitive data should not be used in the ARG or ENV commands 

SecretsUsedInArgOrEnv: Do not use ARG or ENV instructions for sensitive data (ARG "ANTHROPIC_API_KEY")
More info: https://docs.docker.com/go/dockerfile/rule/secrets-used-in-arg-or-env/

Check warning on line 5 in .devcontainer/Dockerfile

View workflow job for this annotation

GitHub Actions / Trivy Container Scan

Sensitive data should not be used in the ARG or ENV commands 

SecretsUsedInArgOrEnv: Do not use ARG or ENV instructions for sensitive data (ARG "ANTHROPIC_API_KEY")
More info: https://docs.docker.com/go/dockerfile/rule/secrets-used-in-arg-or-env/

# Install dependencies and Node.js using official binaries
RUN apt-get update && apt-get install -y \
Expand All @@ -27,13 +27,13 @@
&& apt-get clean \
&& rm -rf /var/lib/apt/lists/*

# Install Doppler CLI
# Install Doppler CLI from GitHub releases for latest security patches
# https://docs.doppler.com/docs/install-cli
RUN curl -sLf --retry 3 --tlsv1.2 --proto "=https" 'https://packages.doppler.com/public/cli/gpg.DE2A7741A397C129.key' | gpg --dearmor -o /usr/share/keyrings/doppler-archive-keyring.gpg \
&& echo "deb [signed-by=/usr/share/keyrings/doppler-archive-keyring.gpg] https://packages.doppler.com/public/cli/deb/debian any-version main" | tee /etc/apt/sources.list.d/doppler-cli.list \
&& apt-get update && apt-get install -y doppler \
&& apt-get clean \
&& rm -rf /var/lib/apt/lists/*
RUN DOPPLER_VERSION="3.75.2" \
&& ARCH=$(dpkg --print-architecture) \
&& curl -sLo /tmp/doppler.deb "https://github.com/DopplerHQ/cli/releases/download/${DOPPLER_VERSION}/doppler_${DOPPLER_VERSION}_linux_${ARCH}.deb" \
&& dpkg -i /tmp/doppler.deb \
&& rm /tmp/doppler.deb
Comment on lines +30 to +36

@coderabbitai coderabbitai Bot Feb 12, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

Add -f (or --fail) to curl to fail fast on HTTP errors.

Without --fail, a 404 (e.g., typo in version or removed release) silently saves the error page as /tmp/doppler.deb, producing a confusing dpkg error. The existing Node.js install on Line 41 uses wget -q which fails on HTTP errors by default.

Proposed fix 
-RUN DOPPLER_VERSION="3.75.2" \
- && ARCH=$(dpkg --print-architecture) \
- && curl -sLo /tmp/doppler.deb "https://github.com/DopplerHQ/cli/releases/download/${DOPPLER_VERSION}/doppler_${DOPPLER_VERSION}_linux_${ARCH}.deb" \
+RUN DOPPLER_VERSION="3.75.2" \
+ && ARCH=$(dpkg --print-architecture) \
+ && curl -sfLo /tmp/doppler.deb "https://github.com/DopplerHQ/cli/releases/download/${DOPPLER_VERSION}/doppler_${DOPPLER_VERSION}_linux_${ARCH}.deb" \
  && dpkg -i /tmp/doppler.deb \
  && rm /tmp/doppler.deb
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
# Install Doppler CLI from GitHub releases for latest security patches
# https://docs.doppler.com/docs/install-cli
RUN curl -sLf --retry 3 --tlsv1.2 --proto "=https" 'https://packages.doppler.com/public/cli/gpg.DE2A7741A397C129.key' | gpg --dearmor -o /usr/share/keyrings/doppler-archive-keyring.gpg \
&& echo "deb [signed-by=/usr/share/keyrings/doppler-archive-keyring.gpg] https://packages.doppler.com/public/cli/deb/debian any-version main" | tee /etc/apt/sources.list.d/doppler-cli.list \
&& apt-get update && apt-get install -y doppler \
&& apt-get clean \
&& rm -rf /var/lib/apt/lists/*
RUN DOPPLER_VERSION="3.75.2" \
&& ARCH=$(dpkg --print-architecture) \
&& curl -sLo /tmp/doppler.deb "https://github.com/DopplerHQ/cli/releases/download/${DOPPLER_VERSION}/doppler_${DOPPLER_VERSION}_linux_${ARCH}.deb" \
&& dpkg -i /tmp/doppler.deb \
&& rm /tmp/doppler.deb
# Install Doppler CLI from GitHub releases for latest security patches
# https://docs.doppler.com/docs/install-cli
RUN DOPPLER_VERSION="3.75.2" \
&& ARCH=$(dpkg --print-architecture) \
&& curl -sfLo /tmp/doppler.deb "https://github.com/DopplerHQ/cli/releases/download/${DOPPLER_VERSION}/doppler_${DOPPLER_VERSION}_linux_${ARCH}.deb" \
&& dpkg -i /tmp/doppler.deb \
&& rm /tmp/doppler.deb
🤖 Prompt for AI Agents 
In @.devcontainer/Dockerfile around lines 30 - 36, The curl invocation that
downloads Doppler (the line setting DOPPLER_VERSION and calling curl to write
/tmp/doppler.deb) should include --fail (or -f) so the build fails on HTTP
errors instead of saving an HTML error page; update the curl command that
references
"https://github.com/DopplerHQ/cli/releases/download/${DOPPLER_VERSION}/doppler_${DOPPLER_VERSION}_linux_${ARCH}.deb"
to add --fail (optionally also --location and --show-error) so dpkg only runs on
a valid .deb.


# Install Node.js
RUN NODE_VERSION=v22.14.0 \
Expand Down
3 changes: 3 additions & 0 deletions .github/workflows/container-security.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,6 +67,7 @@ jobs:
output: 'trivy-results.sarif'
severity: 'CRITICAL,HIGH'
vuln-type: 'os,library'
trivyignores: '.trivyignore'

- name: Upload Trivy scan results to GitHub Security tab
uses: github/codeql-action/upload-sarif@v4
Expand All @@ -81,6 +82,7 @@ jobs:
format: 'table'
severity: 'CRITICAL,HIGH,MEDIUM'
vuln-type: 'os,library'
trivyignores: '.trivyignore'

- name: Fail on critical vulnerabilities
uses: aquasecurity/trivy-action@master
Expand All @@ -90,6 +92,7 @@ jobs:
exit-code: '1'
severity: 'CRITICAL'
vuln-type: 'os,library'
trivyignores: '.trivyignore'

sbom-generation:
name: Generate SBOM
Expand Down
9 changes: 9 additions & 0 deletions .trivyignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,3 +29,12 @@ CVE-2023-24540
# Reason: Transitive dependency via Vercel CLI, esbuild only used at build-time
# Expected resolution: Wait for Vercel to update esbuild
CVE-2024-24790

# CVE-2025-68121: golang: crypto/tls: session resumption vulnerability
# Severity: CRITICAL
# Affected: stdlib v1.24.12 (doppler binary)
# Fixed in: 1.24.13, 1.25.7, 1.26.0-rc.3
# Reason: Doppler CLI is built with older Go stdlib, waiting for upstream update
# Expected resolution: Wait for Doppler to rebuild with patched Go version
# Tracking: https://github.com/DopplerHQ/cli/issues (monitor for Go version update)
CVE-2025-68121
Loading