Security audit findings (2026-09-12)

[github-actions]

The nightly security audit workflow detected one or more findings.
Pro Pushes prueft build.yml::Security gates denselben Stack,
aber zwischen Pushes neu veroeffentlichte Advisories bleiben sonst
unbemerkt — dieser Nightly schliesst die Luecke (Hintergrund:
scripts/open-security-audit-issue.sh Header).

• Workflow run: https://github.com/pt9912/m-trace/actions/runs/34665347849
• govulncheck (apps/api): success
• pnpm audit (TS workspace): success
• Trivy image scan (3 images): failure

Full step output is attached as workflow artifact
security-audit-34665347849 (.tmp/security/*.log); the
tails below show the relevant Vulnerability-Tabelle.

govulncheck (apps/api) — tail

1.26.6: Pulling from library/golang
1da3cb2f93f2: Pulling fs layer
68b64c51cda3: Pulling fs layer
ec935196e6a0: Pulling fs layer
bb2704c1c1eb: Pulling fs layer
fa55d8c7975b: Pulling fs layer
5bf265a321f3: Pulling fs layer
4f4fb700ef54: Pulling fs layer
fa55d8c7975b: Waiting
5bf265a321f3: Waiting
bb2704c1c1eb: Waiting
4f4fb700ef54: Waiting
68b64c51cda3: Verifying Checksum
68b64c51cda3: Download complete
1da3cb2f93f2: Verifying Checksum
1da3cb2f93f2: Download complete
ec935196e6a0: Verifying Checksum
ec935196e6a0: Download complete
5bf265a321f3: Download complete
4f4fb700ef54: Verifying Checksum
4f4fb700ef54: Download complete
fa55d8c7975b: Verifying Checksum
fa55d8c7975b: Download complete
bb2704c1c1eb: Verifying Checksum
bb2704c1c1eb: Download complete
1da3cb2f93f2: Pull complete
68b64c51cda3: Pull complete
ec935196e6a0: Pull complete
bb2704c1c1eb: Pull complete
fa55d8c7975b: Pull complete
5bf265a321f3: Pull complete
4f4fb700ef54: Pull complete
Digest: sha256:0d1d3a794be25f809dd2cb3160d8c73276c4056a9f8242a138e908ddeee7b6b6
Status: Downloaded newer image for golang:1.26.6
go: downloading golang.org/x/vuln v1.1.4
go: downloading golang.org/x/telemetry v0.0.0-20240522233618-39ace7a40ae7
go: downloading golang.org/x/mod v0.22.0
go: downloading golang.org/x/tools v0.29.0
go: downloading golang.org/x/sync v0.10.0
No vulnerabilities found.

pnpm audit (TS workspace) — tail

#17 2.826    ╭──────────────────────────────────────────────╮
#17 2.826    │                                              │
#17 2.826    │     Update available! 11.20.0 → 12.4.1.      │
#17 2.826    │     Changelog: https://pnpm.io/v/12.4.1      │
#17 2.826    │   To update, run: corepack use pnpm@12.4.1   │
#17 2.826    │                                              │
#17 2.826    ╰──────────────────────────────────────────────╯
#17 2.826 
#17 2.977 Progress: resolved 435, reused 0, downloaded 140, added 8
#17 3.977 Progress: resolved 435, reused 0, downloaded 406, added 29
#17 4.756 ✓ Lockfile passes supply-chain policies (515 entries in 3.9s)
#17 4.863 Progress: resolved 435, reused 0, downloaded 435, added 435, done
#17 5.057 [WARN] Failed to create bin at /workspace/apps/analyzer-service/node_modules/.bin/m-trace. ENOENT: no such file or directory, open '/workspace/packages/stream-analyzer/dist/cli/main.cjs'
#17 5.123 
#17 5.123 devDependencies:
#17 5.123 + @playwright/test 1.59.1
#17 5.123 + eslint 10.3.0
#17 5.123 + eslint-plugin-svelte 3.17.1
#17 5.123 + globals 17.6.0
#17 5.123 + hls.js 1.6.16
#17 5.123 + svelte-eslint-parser 1.6.0
#17 5.123 + tsup 8.5.1
#17 5.123 + typescript 6.0.3
#17 5.123 + typescript-eslint 8.59.1
#17 5.123 + vitest 4.1.5
#17 5.123 
#17 5.150 Done in 4.9s using pnpm v11.20.0
#17 DONE 5.2s

#18 [audit 1/1] RUN pnpm audit --audit-level high
#18 0.853 15 vulnerabilities found
#18 0.853 Severity: 2 low | 13 moderate
#18 DONE 0.9s

#19 exporting to image
#19 exporting layers
#19 exporting layers 6.1s done
#19 writing image sha256:7dc585ef4cc12935430139a29666bad52b09bfc2f43b91bbd64f8314f21650c5 done
#19 naming to docker.io/library/m-trace-ts:audit done
#19 DONE 6.1s

Trivy image scan — tail

#17 4.278 CLI tsup v8.5.1
#17 4.280 CLI Target: es2022
#17 4.280 CLI Cleaning output folder
#17 4.281 ESM Build start
#17 4.282 CJS Build start
#17 4.303 ESM dist/main.js 6.58 KB
#17 4.303 ESM ⚡️ Build success in 21ms
#17 4.303 CJS dist/main.cjs 6.62 KB
#17 4.303 CJS ⚡️ Build success in 21ms
#17 DONE 4.3s

#18 [build 11/11] RUN pnpm --filter @pt9912/analyzer-service deploy --prod /deploy
#18 0.685 Packages are copied from the content-addressable store to the virtual store.
#18 0.685   Content-addressable store is at: /root/.local/share/pnpm/store/v11
#18 0.685   Virtual store is at:             ../deploy/node_modules/.pnpm
#18 0.696 ../deploy                                | Progress: resolved 1, reused 0, downloaded 0, added 0
#18 0.698 ../deploy                                |   +1 +
#18 0.793 ../deploy                                | Progress: resolved 1, reused 1, downloaded 0, added 1, done
#18 DONE 0.8s

#19 [runtime 5/5] COPY --from=build /deploy ./
#19 DONE 0.0s

#20 exporting to image
#20 exporting layers
#20 exporting layers 0.7s done
#20 writing image sha256:2fb2ceda6d08936c1d29b4179b2316094cb0d05d2a2e3fc0fa6f6ff510dbc29f done
#20 naming to docker.io/library/mtrace-analyzer-service:scan done
#20 DONE 0.7s
mkdir -p .security/.trivy-cache
# `.security/.trivyignore` wird pro Image aus
# `.security/vulnignore.yaml` generiert (single-source-of-truth +
# audit trail). Der Generator bricht ab, falls ein Eintrag das
# `expires`-Datum ueberschritten hat — Wartungsregel laut
#  Scope-Filterung verhindert, dass ein CVE-Ignore
# fuer ein Runtime-Image global alle Image-Scans maskiert.
bash scripts/render-trivyignore.sh mtrace-api
render-trivyignore: CVE-2026-11822 expired (2026-09-12) — renew or remove the entry.
render-trivyignore: CVE-2026-11824 expired (2026-09-12) — renew or remove the entry.
make: *** [Makefile:891: image-scan] Error 1

Reaction

1. Identify the failing check(s) above and read the full log in the
   artifact.
2. govulncheck: bump the offending Go dependency in
   apps/api/go.mod, run make vuln-check locally to confirm.
3. pnpm audit: either bump the offending package or add a
   pnpm.overrides entry in the root package.json (same
   pattern as picomatch/devalue). Re-run
   make lock-refresh && make audit-ts locally.
4. Trivy image scan: identify the OS package or layer responsible
   in the offending Dockerfile and bump the base image / package
   version. If a finding is a knowingly accepted risk, add an entry
   to .security/vulnignore.yaml with an expires date
   (max 30 days) and a justification — make image-scan regenerates
   the per-image .trivyignore automatically.
5. Push the fix; the next Nightly verifies that the gate is green
   again. If the issue stays open beyond 7 days, escalate via the
   Tranche-3 risks backlog (docs/plan/planning/risks-backlog.md).