published Jul 28, 2026, 1:30 AM · updated Jul 29, 2026, 4:23 PM
Problem
A final-image scan of artifacts selected by gh-aw v0.82.14 found vulnerable packages in the gh-aw-owned gh-aw-node image (ghcr.io/github/gh-aw-node@sha256:529d02eb...). Key findings: libcrypto3/libssl3 3.5.6-r0 (fix: 3.5.7+) and musl 1.2.6-r2 (fix pending). Additionally, gh-aw-mcpg v0.4.3 remains affected — updating from v0.4.1 to v0.4.3 did not resolve MCP gateway findings.
Context
Original report: github/gh-aw#47396
Root Cause
The gh-aw-node base image (Alpine-based) is pinned to a digest that includes outdated versions of OpenSSL and musl. Release cadence does not automatically pull updated Alpine packages.
Proposed Solution
In the gh-aw-node Dockerfile, upgrade to Alpine 3.22+ or explicitly install libcrypto3>=3.5.7 and libssl3>=3.5.7 via apk add --upgrade. Add a Dependabot or Renovate rule to auto-PR base image digest bumps. Pin gh-aw-mcpg to a version with confirmed clean scan results once the component repository publishes one.
Generated by Firewall Issue Dispatcher · sonnet46 · 33 AIC · ⊞ 6.4K · ◷