Security results: v0.3.1 (patch of Operate)#

Recorded on 2026-10-26 from the public CI history and from status-summary.md. Rules: README.md.

What was run, and on which commit#

Release commit (tag v0.3.1)	f710235, 2026-10-26
Commit the full security run was made on	99365c4 ("Dockerfile: nginx images upgrade every Alpine package (curl CVE-2026-92392)"), one commit before the release commit
What differs between the two	the version number in 21 package.json files, the release entry of CHANGES.md, the alignment line of docs/release/README.md and the release notes (the "Known limits" section). No code.
The run	workflow security, started by hand with the DAST scan ticked: run 40297447238, 2026-10-26, 09:09 UTC
Result	all jobs succeeded
The run on the release commit itself	push run 40301598789: success (a push runs the static scans only; the commit has no code change)
Other runs on the tag	upgrade 40301600471 (v0.3.0 to this tree): success; release 40301598928 (six images for amd64 and arm64, cosign signature, build provenance, draft release): success

Job	What it does	Result
static scans	dependency audit, secret scan of the tree and of the history, static analysis, shell lint, container and infrastructure configuration	success (the accepted findings are in scripts/security/static/baseline.json, each with a reason and a review date)
API + browser suites on a disposable stack	the API security suites, the unit tests, the browser tests, and the scan of the stack's images	success
workspace isolation (two stacks)	two workspaces started side by side; one must not reach the other	success
DAST (OWASP ZAP)	active scan of the running stack	success
TLS template (testssl.sh), two nginx images	the TLS policy of the rendered proxy configuration	success (both images)

Counts, read from the reports of run 40297447238 (commit 99365c4): API suites 2337 passed, 0 failed, 2 skipped (92 test files); browser tests 56 passed, 0 failed, 5 skipped; isolation 14 passed, 0 failed. The reports are attached to the GitHub Release (security-reports-v0.3.1.zip), with the CycloneDX SBOMs of the source and of the six images.

The static report lists, as warnings that do not fail the run, the same four semgrep hits as in 0.3.0 (three bypass-tls-verification in packages/core/src/db/client.test.ts, one react-dangerouslysetinnerhtml in packages/sdk/react/src/defaults.tsx), still not in the baseline. Moderate and low advisories are listed as information: @tiptap/core, katex, postcss-selector-parser, sanitize-html (as in 0.3.0) and, new since 0.3.0, nodemailer (three, address parsing) and fast-uri (four). None is high or critical; they are not fixed in this release.

Image scan (trivy image, HIGH/CRITICAL, fixed only), run 40297447238: five own images (core-api, asset-processor, gateway, admin-dashboard, whoobe-one-spike) and garage 0; the sixth, publisher, is not in the scan (see below and F-063); postgres:16-alpine 26, all in the Go standard library of gosu (reported, not gating, decision of the owner 2026-10-23; F-050).

The published images. After the release run, the six images on ghcr.io were checked by digest (the digests are in the release notes of the GitHub Release):

• the cosign signature of each image (keyless, identity https://github.com/swina/whoobe_project/.github/workflows/release.yml@refs/tags/v0.3.1, issuer https://token.actions.githubusercontent.com): verified, 6 of 6;
• the SLSA build provenance stored with each image (cosign verify-attestation --new-bundle-format --type slsaprovenance1, same workflow and tag): verified, 6 of 6;
• trivy image 0.58.1 (HIGH/CRITICAL, fixed only) on the published digests, amd64: 0 for core-api, asset-processor, gateway, admin-dashboard and whoobe-one-spike; 171 (11 critical) for publisher.

The publisher image was never in the CI image scan: run-trivy-image.sh lists the images with docker compose config --images, and the publisher sits behind the compose profile publisher. This is a gap of the test, found after the tag, and the same holds for every earlier release record. The 171 are almost all in build tools shipped with the image: the Go standard library of three esbuild binaries (115), pnpm 9.0.0 left by corepack in /root/.cache and the npm of the node base image (about 40), and dev and build packages of the app's tree (vite 5.4.21 and 6.4.3, vitest 1.6.1, tinypool, devalue 5.9.0, brace-expansion). The publisher is optional (compose profile), publishes no port and runs these tools only for the site builds the dashboard asks for. Recorded as F-063 (Medium, open); the fix (scan the profile images in CI, slim the image) goes into a later patch.

The SBOMs of the six images attached to the release were generated by trivy from the published digests.

The runs that failed first#

Since 0.3.0, before the green runs:

Run	Commit	Result	What the record of the day says
40076769434 and 40176467410 (nightly, 2026-10-24 and 25)	b9546f7	failure in static scans	pnpm audit --prod: four new high advisories, in zod, body-parser, multer and undici; fixed by upgrading them (F-003, CHANGES.md 2026-10-25)
40216804994 (by hand, DAST)	637a1c1	failure in API + browser suites, step Container images	brotli-libs 1.2.0-r1 in the two nginx images (HIGH CVE-2026-111497); added to the packages upgraded at build time (F-050)
40295025888 (by hand, DAST) and 40295482487 (nightly)	99c5041	failure in the same step	curl/libcurl 8.22.0-r0 in the same two images (HIGH CVE-2026-92392); the two images now upgrade every Alpine package at build time (F-050)

What this run did not cover#

The list of v0.3.0 still holds; nothing of it was done for this patch. For this release in particular:

• the publisher image (above, F-063);

• the move to Zod 4 was checked by the unit and API suites only: a manual try of the site wizard, the import of a site specification and writes through the gateway on a running stack was not done (release notes, "Known limits");

• the two nginx images now depend on the build date as well as on the base digest (every Alpine package is upgraded when they are built); the result is the image scan above, not a review of each package.

Open items at the time#

Listed with owner and reason in status-summary.md, section 3: F-003 (moderate advisories listed above; braces, high with no fix, accepted until 2027-01-31), F-008, F-014, F-050 (gosu in the postgres image), F-063 (the publisher image), the TLS check on a live host. The register has no entry kept private under the disclosure policy.