fix(deps): bump grpc to 1.82.1 and refresh OS packages

[hannavigil]

The scheduled Trivy scan on main has been red since 2026-07-21 on unchanged code (47cb6c85 the whole time). What moved is the CVE feed, not axon.

Counts drift daily, so this is stated per group against the 2026-08-03 run (40 findings, up from 23 on 07-30):

Group	08-03 run	Fixed by
linux-libc-dev	29	apt refresh, here
libexpat1	4	apt refresh, here
google.golang.org/grpc	1	grpc bump, here
brace-expansion ×4, axios, engine.io	6	SNYK_BROKER_VERSION bump, here, fix lives in snyk-broker
	40	all 40

This should take the gate to 0. The gate fails on any finding at all (COUNT -gt 0 → exit 1), so partial coverage keeps it red.

OS packages: the fixes were already in the archive

The APT_CACHE_BUST ARG documents this exact remedy. Verified against the live archive rather than assumed:

$ docker run --rm debian:stable-slim apt-cache policy linux-libc-dev libexpat1
linux-libc-dev:  Candidate: 6.12.100-1
libexpat1:       Candidate: 2.8.2-1~deb13u1

• libexpat1: all 21 open alerts report installed 2.7.1-2 → fixed 2.8.2-1~deb13u1, which is the current stable-security candidate. This group did not exist on 07-30; it appeared on 07-31.
• linux-libc-dev: there are now two fix bands, 189 alerts wanting 6.12.96-1 and 68 newer ones wanting 6.12.100-1. The candidate is 6.12.100-1, so both clear. Note the newest band needs exactly today's candidate, so the layer has to genuinely re-resolve.

Why the value had to change, not just the workflow re-run. docker.yml caches layers with actions/cache under restore-keys: ${{ runner.os }}-buildx-, a prefix match, and cache-from: type=local. It passes only BUILD_VERSION as a build-arg, so this ARG default is what keys the apt layer. Re-running CI without editing the value serves the previously built layer and the OS findings persist.

Worth flagging: these are kernel headers and an XML parser pulled in by build-essential in the runtime stage. Containers use the host kernel, so linux-libc-dev is not exploitable in the shipped image. The durable fix is to stop shipping build-essential at runtime, but scaffold apps build on top of this image, so that is a larger change than a vuln pass should make.

grpc: the previous fix aged into the affected range

GHSA-hrxh-6v49-42gf affects grpc through 1.82.0. agent/go.mod sat at v1.79.3, the version #92 moved to in March to clear CVE-2026-33186.

Every module that declares grpc is bumped, not only the one Trivy sees, because #92 fixed agent alone and left scaffold/go/axon_client for dependabot to catch in #93.

Module	Was	Now	Verified by
agent	v1.79.3	1.82.1	make setup proto + make test → 176 PASS / 0 FAIL, 12 packages
sdks/go	v1.68.0	1.82.1	make test → 8 PASS / 0 FAIL
scaffold/go/axon_client	v1.79.3	1.82.1	go build ./... + go vet ./... clean
examples/go/axon-ev-sync	v1.68.0 (indirect)	1.82.1	go build ./... + go vet ./... clean

This also clears two dependabot CRITICALs the image scan never surfaced, GHSA-p77j-4mvh-x3m3 against sdks/go and examples/go/axon-ev-sync. Trivy only reads the compiled agent binary's build info, so neither appeared there.

go mod tidy also carried protobuf 1.36.10 → 1.36.11 and genproto forward as grpc 1.82.1 requires, and pulled sdks/go off x/net v0.33.0 → v0.53.0.

npm: fixed in snyk-broker, pinned here

The 6 npm findings are not in this repo. There is no package.json here. They come from git clone cortexapps/snyk-broker at SNYK_BROKER_VERSION, so clearing them needs a change there plus a new tag. That is cortexapps/snyk-broker#26, now merged and tagged v1.0.17-axon.

Package	Was	Now	Advisory	Patched in
axios	1.16.0	1.19.0	GHSA-gcfj-64vw-6mp9	1.18.0
engine.io	6.6.6	6.6.9	GHSA-r635-g3xr-vw7x	6.6.7
brace-expansion (2.x)	2.0.3	2.1.4	CVE-2026-13149 + CVE-2026-14257	2.1.2 / 2.1.3
brace-expansion (1.x)	1.1.13	1.1.18	CVE-2026-13149 + CVE-2026-14257	1.1.16 / 1.1.17

Correcting an earlier draft of this description: it claimed CVE-2026-14257 is fixed in 5.0.8 only, with no 1.x or 2.x backport, so both copies would need an overrides jump to 5.x. That is wrong. Backports exist at 1.1.17 and 2.1.3, so the fix is a patch bump inside each major line.

Only 2 of the 7 lockfile copies ship. The other 5 are dev: true and die in this Dockerfile's npm prune --omit=dev. The two survivors need different major lines, so one flat override cannot serve both: the 2.x copy comes from root minimatch ^5.1.9, and the 1.x copy via bunyan → mv → minimatch@3. Hence the scoped override in #26.

snyk-broker CI is green on that change: npm ci clean, npm test green (unit 46/46 and 354 tests, functional 26/27 and 144 tests), and npm audit --omit=dev reports 0 critical and 0 high, which also covers the two production transitive deps axios 1.19.0 adds (https-proxy-agent 5.0.1, agent-base 6.0.2).

Verification

Go work ran in golang:1.26.5, matching agent/go.mod. sdks/go was additionally checked against a pristine origin/main worktree with only the go.mod/go.sum change patched in, to confirm the result was not an artifact of a local tree. Baseline RC=0 / 8 PASS, patched RC=0 / 8 PASS, identical.

The image build and the Trivy scan are CI's job. docker-tests builds the real image and then builds scaffold apps on it (scaffold_test.sh go, scaffold_test.sh python), which is the coverage that matters for an unpinned apt-get upgrade.

Residual, not fixed here

scaffold/go/go.mod is a Go text template (module github.com/cortexapps/axon_apps/{{.ProjectName}}), so it is not a resolvable module and go get cannot run there. It still pins grpc v1.68.0 for generated apps. Separately, dependabot has a HIGH on protobuf < 5.29.6 in sdks/python/poetry.lock, a different ecosystem and not part of this pass.

🤖 Generated with Claude Code