[container-image-scan] Container findings for ghcr.io/github/gh-aw-mcpg:v0.4.8

### Summary

- **Image**: `ghcr.io/github/gh-aw-mcpg:v0.4.8`
- **Pinned reference**: `ghcr.io/github/gh-aw-mcpg:v0.4.8@sha256:38bbea36cdb46a3c9d04d1db05e672966f5239b431a2022eb35881688e5721d8`
- **Vulnerabilities**: 6 total (0 Critical, 6 High)
- **License violations**: 59

#### Vulnerabilities

6 vulnerabilities (click to expand)

- **High**: GO-2026-5037: stdlib@go1.26.3 (fix: 1.25.11, 1.26.4) (https://go.dev/cl/783621)
- **High**: GO-2026-5970: golang.org/x/text@v0.37.0 (fix: 0.39.0) (https://go.dev/issue/80142)
- **High**: GO-2026-5970: golang.org/x/text@v0.38.0 (fix: 0.39.0) (https://go.dev/issue/80142)
- **High**: GO-2026-4970: stdlib@go1.26.4 (fix: 1.25.12, 1.26.5, 1.27.0-rc.2) (https://go.dev/issue/79005)
- **High**: GHSA-f5mr-q85p-6hh6: github.com/sigstore/fulcio@v1.8.5 (fix: 1.8.6) (https://github.com/advisories/GHSA-f5mr-q85p-6hh6)
- **High**: GHSA-hrxh-6v49-42gf: google.golang.org/grpc@v1.81.1 (fix: 1.82.1) (https://github.com/advisories/GHSA-hrxh-6v49-42gf)

#### Licenses

59 license policy violations (click to expand)

- ca-certificates-bundle@20260611-r0 (MPL-2.0)
- libgcc@15.2.0-r5 (LGPL-2.1-or-later, GPL-2.0-or-later)
- libsasl@2.1.28-r9 (BSD-3-Clause-Attribution, BSD-4-Clause)
- libldap@2.6.13-r0 (OLDAP-2.8)
- libncursesw@6.6_p20260516-r0 (X11)
- zlib@1.3.2-r0 (Zlib)
- libgcrypt@1.12.2-r0 (GPL-2.0-or-later, LGPL-2.1-or-later)
- libgpg-error@1.61-r0 (GPL-2.0-or-later, LGPL-2.1-or-later)
- passt@2026.05.26-r0 (GPL-2.0-or-later)
- glib@2.88.1-r1 (LGPL-2.1-or-later)
- libmount@2.42.1-r0 (LGPL-2.1-or-later)
- libcap2@2.78-r0 (GPL-2.0-only)
- alpine-baselayout@3.7.2-r1 (GPL-2.0-only)
- ca-certificates@20260611-r0 (MPL-2.0)
- gnupg-gpgconf@2.4.9-r1 (GPL-3.0-or-later)
- gpgsm@2.4.9-r1 (GPL-3.0-or-later)
- libunistring@1.4.2-r0 (GPL-2.0-or-later, LGPL-3.0-or-later)
- zstd-libs@1.5.7-r2 (GPL-2.0-or-later)
- libmnl@1.0.5-r2 (LGPL-2.1-or-later)
- alpine-baselayout-data@3.7.2-r1 (GPL-2.0-only)
- gnupg-keyboxd@2.4.9-r1 (GPL-3.0-or-later)
- libidn2@2.3.8-r0 (GPL-2.0-or-later, LGPL-3.0-or-later)
- musl-utils@1.2.6-r2 (GPL-2.0-or-later)
- libtasn1@4.21.0-r0 (LGPL-2.1-or-later)
- libnftnl@1.3.1-r0 (GPL-2.0-or-later)
- fuse3@3.18.2-r0 (GPL-2.0-only, LGPL-2.1-only)
- libbz2@1.0.8-r6 (bzip2-1.0.6)
- libapk@3.0.6-r0 (GPL-2.0-only)
- gdbm@1.26-r0 (GPL-3.0-or-later)
- crun@1.28-r0 (GPL-2.0-or-later, LGPL-2.1-or-later)
- pinentry@1.3.2-r0 (GPL-2.0-or-later)
- libblkid@2.42.1-r0 (LGPL-2.1-or-later)
- gnupg-dirmngr@2.4.9-r1 (GPL-3.0-or-later)
- gpg@2.4.9-r1 (GPL-3.0-or-later)
- gpg-agent@2.4.9-r1 (GPL-3.0-or-later)
- scanelf@1.3.9-r1 (GPL-2.0-only)
- busybox-binsh@1.37.0-r31 (GPL-2.0-only)
- ssl_client@1.37.0-r31 (GPL-2.0-only)
- bash@5.3.9-r1 (GPL-3.0-or-later)
- gnutls@3.8.13-r0 (LGPL-2.1-or-later)
- libassuan@3.0.2-r0 (LGPL-2.1-or-later)
- apk-tools@3.0.6-r0 (GPL-2.0-only)
- nftables@1.1.6-r1 (GPL-2.0-or-later)
- gpgme@2.0.1-r1 (LGPL-2.1-or-later, GPL-3.0-or-later)
- readline@8.3.3-r1 (GPL-3.0-or-later)
- gmp@6.3.0-r4 (GPL-2.0-or-later, LGPL-3.0-or-later)
- fuse-common@3.18.2-r0 (GPL-2.0-only, LGPL-2.1-only)
- sqlite-libs@3.53.2-r0 (blessing)
- fuse3-libs@3.18.2-r0 (GPL-2.0-only, LGPL-2.1-only)
- libksba@1.7.0-r0 (GPL-3.0-only, LGPL-3.0-only, GPL-2.0-only)
- npth@1.8-r0 (LGPL-2.0-or-later)
- catatonit@0.2.1-r0 (GPL-2.0-or-later)
- fuse-overlayfs@1.16-r0 (GPL-2.0-or-later)
- nettle@3.10.2-r0 (GPL-2.0-or-later, LGPL-3.0-or-later)
- libintl@1.0-r0 (LGPL-2.1-or-later)
- libseccomp@2.6.0-r2 (LGPL-2.1-or-later)
- libmd@1.2.0-r0 (AND, Beerware, Domain, Public)
- ncurses-terminfo-base@6.6_p20260516-r0 (X11)
- busybox@1.37.0-r31 (GPL-2.0-only)

#### Remediation

- Rebuild with Go 1.25.12/1.26.5+ to fix GO-2026-5037 and GO-2026-4970.
- Bump golang.org/x/text to 0.39.0+ to resolve GO-2026-5970.
- Bump github.com/sigstore/fulcio to 1.8.6+ to resolve GHSA-f5mr-q85p-6hh6.
- Bump google.golang.org/grpc to 1.82.1+ to resolve GHSA-hrxh-6v49-42gf.
- Review flagged GPL/LGPL Alpine and gnupg-related license violations against project policy.

> Generated by [🛡️ Daily Container Image Security Scan](https://github.com/github/gh-aw/actions/runs/31360089580) · auto · 445.4 AIC · ⌖ 18.1 AIC · ⊞ 6.5K · [◷](https://github.com/search?q=repo%3Agithub%2Fgh-aw+is%3Aissue+%22gh-aw-workflow-call-id%3A+github%2Fgh-aw%2Fdaily-squid-image-scan%22&type=issues)