CP-47350: Repin bundled Alloy to v1.19.2-patch-1 - #1000
Open
evan-cz wants to merge 3 commits into
Open
Conversation
Restores the ability to merge anything into this repository. The image vulnerability gate fails on every pull request, and every finding it reports comes from the Alloy binary bundled into the agent image rather than from code built here: six Go standard library advisories, one in Apache Thrift, and one in gRPC, all rated high. Nothing in this repository introduced them. The advisories were published after the pinned image was built, and the scanner refreshes its database daily, so the gate began failing on its own. The build this pin now selects carries none of them. Scanning it reports no vulnerabilities at any severity. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Greptile SummaryUpdates the Alloy binary bundled in the agent image from v1.18.1 to v1.19.2-patch-1 to clear vulnerabilities reported against the previous image.
Confidence Score: 5/5The PR appears safe to merge. No blocking failure remains. Important Files Changed
Reviews (3): Last reviewed commit: "CP-47350: rebuild against the corrected ..." | Re-trigger Greptile |
josephbarnett
approved these changes
Sep 4, 2026
Contributor
Author
|
Rebuilding against the re-tagged |
The v1.19.2-patch-1 tag now points at a build carrying etcd v3.6.14, which clears GO-2026-6107. No content change; this exists only to retrigger the image build so the scan runs against the new image. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
v1.19.2-patch-1 now points at a build whose OpenTelemetry modules agree on one semantic-convention schema. The previous image passed the vulnerability scan but could not start in clustered mode: the tracer failed to build on conflicting schema URLs and the container crash-looped. No content change; this retriggers the image build so the scan and the version matrix run against the corrected Alloy. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The image vulnerability gate fails on every pull request, blocking all merges. Every finding it reports comes from the Alloy binary bundled into the agent image rather than from code built in this repository: six Go standard library advisories, one in Apache Thrift, and one in gRPC, all rated high.
Nothing here introduced them. The advisories were published after the pinned image was built, and the scanner refreshes its database daily, so the gate began failing on its own.
Verification. Scanning the newly pinned image directly:
Clean at every severity, not just above the high cutoff.
Note on scope. This moves the bundled Alloy across an upstream minor version (1.18.1 to 1.19.2), not just a patch suffix. There is no smaller option: the v1.18.1 lineage carries the same vulnerable base, so clearing the gate requires the 1.19.2 lineage. Prior CVE-driven repins have crossed minor versions the same way.
Stacked. The Go toolchain bump builds on this branch and is needed alongside it — this repin fixes only the binary that comes from elsewhere, while the nine binaries built here carry the same stdlib advisories independently.
🤖 Generated with Claude Code