gh-aw-node contains vulnerable packages and released component pins need refresh

[loganrosen]

Summary

A final-image scan of the artifacts selected by gh-aw v0.82.14 found:

1. Vulnerable packages in the gh-aw-owned gh-aw-node image.
2. Component pins referencing releases with findings tracked in their owning repositories.

This issue tracks the gh-aw-owned image and the integration work needed after clean component releases become available. It does not duplicate remediation ownership from the component repositories.

gh-aw-owned finding

gh-aw-node

Affected image:

ghcr.io/github/gh-aw-node@sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b

Package	Installed version	Reported fixed version	Finding
libcrypto3 / libssl3	3.5.6-r0	3.5.7+	Multiple OpenSSL advisories
musl	1.2.6-r2	To be confirmed	CVE-2026-40200
tar	7.5.13	7.5.19+	Package advisory
brace-expansion	5.0.5	5.0.7+	Package advisory
sigstore	4.1.0	4.1.1+	Package advisory
undici	6.25.0	6.27.0+	Package advisory

The safe-output MCP runtime primarily executes Node, local JavaScript, and git, so some npm-network findings may not be reachable in normal operation. The affected packages nevertheless remain present in the published image.

Verification should record the exact advisory ID, scanner severity, package path, and runtime applicability for every finding.

Related component findings

• Agent and API-proxy images: github/gh-aw-firewall#6504
• Squid image license inventory: github/gh-aw-firewall#6506
• MCP gateway image: github/gh-aw-mcpg#9836
• GitHub MCP server fixes: github/github-mcp-server#2927

The Squid issue concerns license inventory rather than vulnerable packages. It is listed here only as a gh-aw-firewall release-readiness dependency, not as CVE remediation. The GitHub MCP server fixes are merged, but a patch release containing them is still pending.

Released pins

gh-aw v0.82.14 selects:

• gh-aw-firewall v0.27.37
• gh-aw-mcpg v0.4.1
• github-mcp-server v1.6.0
• gh-aw-node digest 529d02eb...

Current main already selects gh-aw-mcpg v0.4.3, but that update is not present in v0.82.14.

For this investigation, the baseline is v0.82.14 and the supported target is the latest non-prerelease gh-aw release available when remediation is published. Final-image verification should cover both linux/amd64 and linux/arm64.

Work that can proceed immediately

• Resolve and record the immutable platform digests for the current gh-aw-node image.
• Generate a final-image SBOM and vulnerability report for each supported platform.
• Record every finding's advisory ID, severity, installed version, fixed version, package path, and runtime applicability.
• Refresh the gh-aw-node base/runtime packages and npm dependencies as needed.
• Publish and verify an immutable gh-aw-node digest whose remaining findings have documented applicability.

Release-blocked integration work

• Update gh-aw-firewall after releases addressing #6504 and the release-readiness work in #6506.
• Update gh-aw-mcpg after a reviewed release addressing github/gh-aw-mcpg#9836.
• Update github-mcp-server after a patch release containing github/github-mcp-server#2927.
• Publish a gh-aw release with the reviewed component pins and immutable gh-aw-node digest.
• Verify the final selected artifacts for both supported platforms.

Reproduction context

These findings were observed using:

• Syft v1.46.0
• Grype v0.115.0

IMAGE='ghcr.io/github/gh-aw-node@sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b'

syft --platform linux/amd64 "$IMAGE" -o syft-json=sbom.json
grype sbom:sbom.json

The image is multi-architecture, so package inventories may differ by platform.

Completion criteria

A supported gh-aw release references reviewed component releases and an immutable gh-aw-node digest whose remaining findings have documented applicability.

[pelikhan]

https://github.com/github/gh-aw/tasks/5fc8bc10-1d6f-4639-95b1-4ae61ca30f75

[pelikhan]

@lpcox