fix(security): risk-accept containerd v1 advisory GO-2026-6791

[devantler]

🤖 Generated by the Agentic Engineer

Why

A new containerd security advisory, published on 19 October, makes the vulnerability scan fail on every KSail pull request, so nothing can merge. The advisory covers every version of the old containerd module and has no fix, so no upgrade can clear it.

What

Records the advisory as an accepted risk, next to three earlier advisories of the same kind, with the measured reason: KSail only pulls in the old module's image and registry helpers through Kubescape, never the container-runtime code the advisory is about. The entry is to be removed as soon as that old module drops out of KSail's dependencies.

Fixes #7885

[devantler]

🤖 Generated by the Agentic Engineer

Measurement behind the allowlist entry (head b896727b, scan of ksail main @ 3d8b2bcc, 2026-10-20 ~23:15 UTC, govulncheck -json ./..., local scanner v1.7.0 against the live vuln DB):

• The OSV record for GO-2026-6791 lists no symbols or packages (ecosystem_specific is empty), so govulncheck treats any linked package of github.com/containerd/containerd (v1) as reachable. v1 is introduced: 0 with no fixed event; containerd/v2 is fixed in 2.2.7 / 2.3.4, and ksail pins v2.3.6, so only v1 is flagged.
• 19 findings for the ID: 9 module/package-level rows and 10 call traces. Every call trace starts at a package init of one of: content, remotes, images, labels, errdefs, filters, archive/compression, pkg/randutil.
• Entry points: 8 traces end in pkg/client/kubescape.init via kubescape/v3/core/cautils.init → helm.sh/helm/v3/pkg/registry.init → containerd/remotes.init; 2 end in pkg/addressmask.Error through go.uber.org/multierr → sync.Pool.Get → content.init$1 (an interface-dispatch over-approximation, still only an init closure).
• No CRI plugin package (pkg/cri/...) appears in any trace, so the checkpoint-restore code the advisory describes is not linked into ksail.

This is the same shape as the three containerd v1 CRI checkpoint entries already in the file (GO-2026-5064, -5338, -5622), and the entry follows their removal rule.

[devantler]

🤖 Generated by the Agentic Engineer

@coderabbitai full review

[coderabbitai]

✅ Action performed

Full review finished.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository YAML (base), Organization UI (inherited)
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 50b60925-1135-49a0-bef2-308dd93c4a74

📥 Commits

Reviewing files that changed from the base of the PR and between 3d8b2bc and b896727.

📒 Files selected for processing: 1

• .govulncheck-allow.txt

Included review availability: This review used your included allowance. Your plan provides up to 2 included reviews per hour; 0 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout: 1

• GitHub Check: Analyze (go)

🔇 Additional comments: 1

.govulncheck-allow.txt: 1

56-56: 📐 Maintainability & Code Quality

The future-date concern is refuted. The reviewed commit that added the record has a committer timestamp of 2026-10-20T01:16:23+02:00, so 2026-10-20 is not future-dated in the reviewed head.

📝 Walkthrough

The vulnerability scan allowlist now includes GO-2026-6791. The entry records the measured containerd versions, package-linkage evidence, lack of CRI plugin reachability, and absence of a fix for containerd v1. It also notes that containerd/v2 is beyond the patched version.

Priority: ➖ Normal

Severity of issue fixed: Medium

Merge Risk: ⚪ Minimal · up to b8967

This documentation-only change is ready to merge, subject to normal checks.

Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

Failed checks: 1 inconclusive

Check name	Status	Explanation	Resolution
Linked Issues check		Issue #7885 requires a measured govulncheck -json ./... result, a justified mitigation, and a green scan on a fresh PR. .govulncheck-allow.txt records the 2026-10-20 measurement, containerd versio…	Provide the fresh PR govulncheck or CI result that shows GO-2026-6791 is no longer blocking.

Passed checks: 4 passed

Check name	Status	Explanation
Title check		The title clearly and concisely describes the main change: accepting the risk for advisory GO-2026-6791 affecting containerd v1.
Description check		The description explains the advisory, the measured dependency path, the accepted-risk decision, and the removal condition. It is directly related to the changeset.
Out of Scope Changes check		The supplied change summary shows only eight added lines in .govulncheck-allow.txt. The lines document and allowlist GO-2026-6791, which directly addresses issue #7885. No unrelated change is shown.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

Full details: Linked Issues check

Explanation

Issue #7885 requires a measured govulncheck -json ./... result, a justified mitigation, and a green scan on a fresh PR. .govulncheck-allow.txt records the 2026-10-20 measurement, containerd versions, pkg/client/kubescape, the traced package-init paths, and the absence of linked CRI plugin packages. It also adds the advisory in the existing unfixable-risk format. The supplied evidence does not include a fresh PR vulnerability-scan result, so the final green-scan requirement is not established.

Resolution

Provide the fresh PR govulncheck or CI result that shows GO-2026-6791 is no longer blocking.

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devantler]

🤖 Generated by the Agentic Engineer

Readiness at b896727b

• Tested: CI - Required Checks green; both 🛡️ Vulnerability Scan runs (the PR scan and the main-Go-and-allowlist validation) pass with the entry, where every ksail PR scanned after 2026-10-19 21:08 UTC failed on GO-2026-6791 (for example run 39333874762 on feat(validate): support offline Kyverno API-call fixtures #7873). 🔐 Verify Local Source Vulnerability Identities green.
• Reviewed: CodeRabbit full review at this head, requested 23:37:18 UTC, finished 23:40:52 UTC: no actionable comments; zero threads; zero body findings.
• Tried as a user: the user of this file is the PR gate. The scan on this PR is exactly the path that was blocked, and it now passes while no other advisory was added; the measured trace is in the comment above.