- git-lfs is built with Go 1.27.3, golang.org/x/net 0.61.0 and
golang.org/x/crypto 0.58.0.
- Raise the floors for sharp, smol-toml, source-map-js and
http-cache-semantics in the app and the site, and pin the site's vite to
8.1.6.
- The VEX product for the published image is now
pkg:docker/raylabshq/gitea-mirror?repository_url=ghcr.io. The old
pkg:docker/ghcr.io/... form never matched, so the zlib CVE-2026-85091
exception was ignored on main scans.
Review follow-ups after #403 and #404: dialog copy and placeholder, forge-aware owner parser, GitHub only mirror switches available while any connected source is GitHub, configuration header copy, self-contained encryption test. Also builds the Sources card token settings link from validated URL parts (CodeQL alert) and adds a VEX statement for CVE-2026-85091 in zlib, which nothing in the image can reach.
Strip setuid bits and add an OpenVEX exception for the three util-linux CVEs Debian will not fix in trixie, pin golang.org/x/crypto 0.56.0 and x/net 0.58.0 in the git-lfs build, and build git-lfs with Go 1.27.1.
ARUNAVO RAY