Triage 2026-09-29¶
The first pass over the Dependency-Track portfolio, read next to the Trivy Operator reports. The method is in Vulnerability Triage; the image dispositions that did not change are in Triage 2026-09-20.
The data¶
| Finding | Disposition |
|---|---|
| Projects from ReplicaSets scaled to zero, ten of 76, with a quarter of the criticals | Fixed (homelab-apps#77, #983). The upload job skips them |
isLatest on a superseded version |
Fixed (homelab-apps#77). It goes to the highest version that runs |
No project for busybox and hubble-export-stdout |
By design. Neither image has a package Trivy can name, and the operator writes no SbomReport for an empty SBOM |
| No project for Home Assistant | Accepted. Its SBOM names over three thousand components and is larger than one API write may be, so the operator cannot store it; see Pitfalls. The VulnerabilityReport covers the image |
| Most findings carry no severity | By design. They are Go vulnerability database entries, which have none; the same flaw is usually there a second time as a GitHub advisory that does |
Images¶
Every critical on an image that runs. Dependency-Track rates by the advisory's own score, Trivy by the distribution's, so the two disagree on severity more often than on presence.
| Image | Finding | Disposition |
|---|---|---|
Argo CD (bundled git-lfs), dex, snapshot-controller, descheduler, cephcsi, csi-attacher |
Seven golang.org/x/crypto advisories in its SSH server, client and agent |
Not reachable, waiting on release. None of them speaks SSH. Trivy has all seven at severity UNKNOWN, so they never reached its dashboard |
| dex, snapshot-controller | gRPC-Go authorization bypass, CVE-2026-33186 | Not reachable, waiting on release. dex as on 2026-09-20; snapshot-controller is a client, and its image trails the tag by one release, see Velero |
library/nextcloud |
Eight in curl, five in rsync, one in libxml2 |
Nothing to do. No fix in Debian 13. The rsync ones need a daemon or a remote shell, and the image copies files locally. Trivy rates the curl ones below HIGH, where the namespace's ignore policy drops them |
library/nextcloud |
MAL-2022-3033, MAL-2022-3056, "malicious package" |
Scanner artifact. Nextcloud's own files_pdfviewer and firstrunwizard apps share a name with two npm packages. Fixed (homelab-apps#78): the upload job suppresses them for every new tag |
goauthentik/server, cloudnative-pg/postgresql |
libxml2, anyio |
Unchanged since 2026-09-20 |
dependencytrack/apiserver |
FreeMarker template path traversal | Waiting on release. Needs a caller who chooses the locale; the templates here are the notification ones |
janwelker/knead-time-push |
OpenSSL, and in Trivy also perl, sqlite and zlib, none fixed in Debian 12 |
Fixed (knead-time#371, homelab-apps#79). The image moves to a distroless base, which has none of the four packages but OpenSSL's libraries |
What Dependency-Track does not rate critical and Trivy does: the Go
standard library in bundled kustomize, git-lfs, gomplate and s5cmd,
dex's Alpine OpenSSL, and Nextcloud's libopenexr. Neither source is the
whole list.
The operator¶
Found on the way: the operator was being OOM-killed several times a day,
because its cache holds every report and the SbomReports are large. A
kill while a report is written loses it without an error. Fixed in #985.