# Triage 2026-09-29

The first pass over the [Dependency-Track](<https://homelab-apps.wlkr.ch/dependency-track/>) portfolio, read next to the Trivy Operator reports. The method is in [Vulnerability Triage](<https://homelab.wlkr.ch/operations/vulnerabilities/index.md>); the image dispositions that did not change are in [Triage 2026-09-20](<https://homelab.wlkr.ch/operations/triage-2026-09-20/index.md>).

## The data

| Finding | Disposition |
| --- | --- |
| Projects from ReplicaSets scaled to zero, ten of 76, with a quarter of the criticals | **Fixed** (homelab-apps\#77, \#983). The upload job skips them |
| `isLatest` on a superseded version | **Fixed** (homelab-apps\#77). It goes to the highest version that runs |
| No project for `busybox` and `hubble-export-stdout` | **By design.** Neither image has a package Trivy can name, and the operator writes no `SbomReport` for an empty SBOM |
| No project for Home Assistant | **Accepted.** Its SBOM names over three thousand components and is larger than one API write may be, so the operator cannot store it; see [Pitfalls](<https://homelab.wlkr.ch/platform/trivy-operator/#pitfalls>). The `VulnerabilityReport` covers the image |
| Most findings carry no severity | **By design.** They are Go vulnerability database entries, which have none; the same flaw is usually there a second time as a GitHub advisory that does |

## Images

Every critical on an image that runs. Dependency-Track rates by the advisory's own score, Trivy by the distribution's, so the two disagree on severity more often than on presence.

| Image | Finding | Disposition |
| --- | --- | --- |
| Argo CD (bundled `git-lfs`), dex, snapshot-controller, descheduler, cephcsi, csi-attacher | Seven `golang.org/x/crypto` advisories in its SSH server, client and agent | **Not reachable, waiting on release.** None of them speaks SSH. Trivy has all seven at severity `UNKNOWN`, so they never reached its dashboard |
| dex, snapshot-controller | gRPC-Go authorization bypass, CVE-2026-33186 | **Not reachable, waiting on release.** dex as on 2026-09-20; snapshot-controller is a client, and its image trails the tag by one release, see [Velero](<https://homelab.wlkr.ch/platform/velero/#configuration>) |
| `library/nextcloud` | Eight in `curl`, five in `rsync`, one in `libxml2` | **Nothing to do.** No fix in Debian 13. The `rsync` ones need a daemon or a remote shell, and the image copies files locally. Trivy rates the `curl` ones below HIGH, where the namespace's ignore policy drops them |
| `library/nextcloud` | `MAL-2022-3033`, `MAL-2022-3056`, "malicious package" | **Scanner artifact.** Nextcloud's own `files_pdfviewer` and `firstrunwizard` apps share a name with two npm packages. **Fixed** (homelab-apps\#78): the upload job suppresses them for every new tag |
| `goauthentik/server`, `cloudnative-pg/postgresql` | `libxml2`, `anyio` | **Unchanged** since 2026-09-20 |
| `dependencytrack/apiserver` | FreeMarker template path traversal | **Waiting on release.** Needs a caller who chooses the locale; the templates here are the notification ones |
| `janwelker/knead-time-push` | OpenSSL, and in Trivy also `perl`, `sqlite` and `zlib`, none fixed in Debian 12 | **Fixed** (knead-time\#371, homelab-apps\#79). The image moves to a distroless base, which has none of the four packages but OpenSSL's libraries |

What Dependency-Track does not rate critical and Trivy does: the Go standard library in bundled `kustomize`, `git-lfs`, `gomplate` and `s5cmd`, dex's Alpine OpenSSL, and Nextcloud's `libopenexr`. Neither source is the whole list.

## The operator

Found on the way: the operator was being OOM-killed several times a day, because its cache holds every report and the `SbomReport`s are large. A kill while a report is written loses it without an error. Fixed in \#985.