build: upgrade dependencies

[masontikhonov]

What

This upgrades dependencies with fixes to some CVE.

Labels

Assign the following labels to the PR:

security - to trigger image scanning in CI build

PR Comments

Add the following comments to the PR:

/e2e - to trigger E2E build

Security Report

Note

Compared security scans:

Current image:
quay.io/codefresh/dev/compose:cr-32167-security-c9756a6@sha256:0f444d0473b8066171833842fd75e4157a216932a3e711a283a92974cf0d7286

Baseline:
quay.io/codefresh/compose:main@sha256:5ee214a95bf7c9e34a9122240fe6fe529786b7eb85c430d11eb1419a170a3a76

Important

Results in this section may be outdated or incomplete.
Please analyze the full scan report for comprehensive details.

Fixed CVEs: 48

🟣 Critical: 1

• CVE-2023-45853 in zlib@1:1.2.13.dfsg-1 at unknown path

🔴 High: 1

• CVE-2024-25621 in github.com/containerd/containerd/v2@v2.1.1 at /usr/local/bin/docker-compose

🟠 Medium: 5

• GO-2025-3900 in github.com/go-viper/mapstructure/v2@v2.0.0 at /usr/local/bin/docker-compose
• GO-2025-3787 in github.com/go-viper/mapstructure/v2@v2.0.0 at /usr/local/bin/docker-compose
• CVE-2025-47914 in golang.org/x/crypto/ssh/agent@v0.37.0 at /usr/local/bin/docker-compose
• CVE-2025-54388 in github.com/docker/docker@v28.2.2 at /usr/local/bin/docker-compose
• CVE-2025-64329 in github.com/containerd/containerd/v2@v2.1.1 at /usr/local/bin/docker-compose

🟡 Low: 10

• CVE-2025-6297 in dpkg@1.21.22 at unknown path
• CVE-2023-50495 in ncurses@6.4-4 at unknown path
• CVE-2016-2781 in coreutils@9.1-1 at unknown path
• CVE-2025-14104 in util-linux@2.38.1-5+deb12u3 at unknown path
• CVE-2024-22365 in pam@1.5.2-6+deb12u1 at unknown path
• CVE-2025-30258 in gnupg2@2.2.40-1.1+deb12u1 at unknown path
• CVE-2025-6141 in ncurses@6.4-4 at unknown path
• CVE-2025-9820 in gnutls28@3.7.9-2+deb12u5 at unknown path
• CVE-2025-6020 in pam@1.5.2-6+deb12u1 at unknown path
• CVE-2024-10041 in pam@1.5.2-6+deb12u1 at unknown path

⚪️ Unimportant: 16

• CVE-2023-31486 in perl@5.36.0-7+deb12u3 at unknown path
• CVE-2018-6829 in libgcrypt20@1.10.1-3 at unknown path
• CVE-2018-20796 in glibc@2.36-9+deb12u13 at unknown path
• CVE-2022-27943 in gcc-12@12.2.0-14+deb12u1 at unknown path
• CVE-2022-0563 in util-linux@2.38.1-5+deb12u3 at unknown path
• CVE-2017-18018 in coreutils@9.1-1 at unknown path
• CVE-2011-3374 in apt@2.6.1 at unknown path
• CVE-2022-3219 in gnupg2@2.2.40-1.1+deb12u1 at unknown path
• CVE-2011-4116 in perl@5.36.0-7+deb12u3 at unknown path
• CVE-2025-5278 in coreutils@9.1-1 at unknown path
• CVE-2024-2236 in libgcrypt20@1.10.1-3 at unknown path
• CVE-2013-4392 in systemd@252.39-1~deb12u1 at unknown path
• CVE-2011-3389 in gnutls28@3.7.9-2+deb12u5 at unknown path
• CVE-2010-4756 in glibc@2.36-9+deb12u13 at unknown path
• CVE-2007-5686 in shadow@1:4.13+dfsg1-1+deb12u1 at unknown path
• CVE-2005-2541 in tar@1.34+dfsg-1.2+deb12u1 at unknown path

⚫ Unassigned: 15

• CVE-2025-61729 in crypto/x509@1.23.8 at /usr/local/bin/docker-compose
• CVE-2025-61725 in net/mail@1.23.8 at /usr/local/bin/docker-compose
• CVE-2025-61723 in encoding/pem@1.23.8 at /usr/local/bin/docker-compose
• CVE-2025-58188 in crypto/x509@1.23.8 at /usr/local/bin/docker-compose
• CVE-2025-58187 in crypto/x509@1.23.8 at /usr/local/bin/docker-compose
• CVE-2025-47913 in golang.org/x/crypto/ssh/agent@v0.37.0 at /usr/local/bin/docker-compose
• CVE-2025-4673 in net/http@1.23.8 at /usr/local/bin/docker-compose
• CVE-2025-61727 in crypto/x509@1.23.8 at /usr/local/bin/docker-compose
• CVE-2025-47906 in os/exec@1.23.8 at /usr/local/bin/docker-compose
• CVE-2025-61724 in net/textproto@1.23.8 at /usr/local/bin/docker-compose
• CVE-2025-58189 in crypto/tls@1.23.8 at /usr/local/bin/docker-compose
• CVE-2025-58186 in net/http@1.23.8 at /usr/local/bin/docker-compose
• CVE-2025-58185 in encoding/asn1@1.23.8 at /usr/local/bin/docker-compose
• CVE-2025-47912 in net/url@1.23.8 at /usr/local/bin/docker-compose
• CVE-2025-58183 in archive/tar@1.23.8 at /usr/local/bin/docker-compose

[masontikhonov]

/e2e

[masontikhonov]

/e2e

[masontikhonov]

/e2e

[masontikhonov]

/e2e

[masontikhonov]

/e2e