From 2c0caacfb0760674818bcad33c1c2d93bac40a9e Mon Sep 17 00:00:00 2001 From: Thore Cimbal Date: Fri, 21 Aug 2026 12:00:00 +0000 Subject: [PATCH] cve: the cadvisor decision cited a commit that never touched it MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit I wrote that v0.55.1 was waiting in 516641b. It is not — cadvisor is not in this compose file at all; it runs in the portainer stack next door, so nothing here sets its version. The finding stands and the measurement stands, but the reason attached to it was false, and a decision is only worth its reason. Same shape as the portainer agent: measured, outside our deployment path, and therefore dated with the others rather than with this week's rollout. --- monitoring/cve/entscheidungen.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/monitoring/cve/entscheidungen.json b/monitoring/cve/entscheidungen.json index 96dc588..daaeac9 100644 --- a/monitoring/cve/entscheidungen.json +++ b/monitoring/cve/entscheidungen.json @@ -33,8 +33,8 @@ { "ziel": "gcr.io/cadvisor/cadvisor:v0.49.1", "art": "geplant", - "grund": "v0.55.1 liegt im Repo (516641b), gemessen 5 CRITICAL -> 4. Wirkt mit dem Ausrollen auf dem Betriebs-Host.", - "pruefen_am": "2026-08-28", + "grund": "Laeuft im Portainer-Stack 'thread-net-git', NICHT aus diesem Repo - die Fassung wird hier gar nicht gesetzt. GEMESSEN: v0.55.1 traegt 4 statt 5 CRITICAL, also ein schwacher Gewinn. Die Aktualisierung liegt wie beim portainer-agent bei sorb auf dem Betriebs-Host.", + "pruefen_am": "2026-09-21", "cves": [ "CVE-2024-24790", "CVE-2024-37371",