Multiple vulnerabilities found in Alpine Docker image (2.7.11) by Trivy

I scanned the latest Alpine image (2.7.11-alpine) using Trivy and found multiple critical and high severity vulnerabilities:


Here is the same report in PDF: [influxdb-2.7.11-alpine-vulnerabilities.pdf](https://github.com/user-attachments/files/18903065/influxdb-2.7.11-alpine-vulnerabilities.pdf)

I found this issue (https://github.com/influxdata/influxdb/pull/25177) where Go was apparently updated from 1.21.10 to 1.21.12, but the Trivy says the Go version is 1.21.9?

I tried to research some of these vulnerabilities and as far as I understand the dasel vulnerabilities are not really critical or high since it is used only for configuration parsing? There are other vulnerabilities found in influx and influxd binaries though.

These same vulnerabilities are listed in the Dockerhub page: https://hub.docker.com/layers/library/influxdb/2.7.11-alpine/images/sha256-7b910c12adf77fd4494e09c07c69d94bc9027a63ee137c481820af10de30f15b

Are these actual vulnerabilities or false positives? Is there a list of false positive vulnerabilities somewhere?

Start with the linked Trivy report, PDF, and Docker Hub image details for influxdb:2.7.11-alpine, then compare the reported Go and binary vulnerabilities with the image contents. Done would require a maintainer-confirmed determination of which findings are real or false positives and what remediation or reference list applies.

Written by the indexing model from the issue text.