build: update dependencies and base image to fix vulnerabilities - #92
Merged
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
This PR performs a routine dependency and build-environment refresh for the Sysdig MCP Server, updating Go module dependencies, Nix inputs, container base image digests, and pinned GitHub Action SHAs to address reported vulnerabilities.
Changes:
- Bumped Go module dependencies (including
golang.org/x/texttov0.40.0) and refreshedgo.sum. - Updated Nix inputs (
flake.lock) and the Nix package vendoring hash/version (package.nix). - Updated base container image digests for amd64/aarch64 and refreshed pinned GitHub Actions in CI/release workflows.
Reviewed changes
Copilot reviewed 7 out of 9 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| package.nix | Bumps package version and updates vendorHash to match refreshed Go vendoring. |
| go.mod | Updates direct and indirect Go dependency versions (notably x/text). |
| go.sum | Refreshes module checksums to match the updated dependency graph. |
| flake.lock | Updates pinned Nix inputs (e.g., nixpkgs, go-overlay) used by the dev/build environment. |
| docker-base-amd64.nix | Updates pinned sysdig-mini-ubi9 image digest/hash for amd64 builds. |
| docker-base-aarch64.nix | Updates pinned sysdig-mini-ubi9 image digest/hash for aarch64 builds. |
| .github/workflows/stale.yml | Updates the pinned actions/stale SHA/version. |
| .github/workflows/pull-request-ci.yaml | Updates pinned action SHAs (checkout/docker actions) used in PR CI. |
| .github/workflows/publish.yaml | Updates pinned action SHAs (checkout/docker/release actions) used in publish/release workflow. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
tembleking
enabled auto-merge (squash)
August 7, 2026 14:21
alecron
approved these changes
Aug 7, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Routine
just updatesweep. Bumps Go deps, the sysdig-mini-ubi9 base image digest, and pinned GitHub Actions.Clears three vulnerabilities flagged by govulncheck:
govulncheck ./...now reports no findings.Base image CVEs cleared
The base image digest bump advances these OS packages, clearing 11 CVEs:
gnutls, openssl-libs and p11-kit also advance but add no net-new CVEs over the previous digest.