security: temporalio/ui:2.54.1 - docker scout 9 critical / 18 high
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 431
- Forks
- 179
- Avg merge
- 2d 9h
- Merged PRs (30d)
- 71
Description
Summary
Docker Scout on temporalio/ui:latest (tag 2.54.1, linux/arm64 digest 30c5afbff065) reports 9 Critical and 18 High on the target image.
This is a follow-up to #3840, #3664, #3665, and #1703 (those track older module/Go versions than what 2.54.1 ships). Provenance: temporalio/ui-server commit a1f4261 (sync from UI release v2.54.1).
Target vs base
| Image | C | H | M | L | Unspecified |
|---|---|---|---|---|---|
Target temporalio/ui:2.54.1 |
9 | 18 | 13 | 1 | 3 |
Base alpine:3 (Scout auto-detect) |
4 | 21 | 8 | 3 | — |
Policy: FAILED (4/7). Fixable C/H: 9C 17H. Health score C (56%).
The 9C/18H are on the finished UI image, not only on stock Alpine.
Critical / High by package
| Count | Package | Where it appears in this image |
|---|---|---|
| 7C 5H | golang.org/x/crypto 0.47.0 |
dockerize (go install github.com/jwilder/dockerize@v0.10.1 in server/Dockerfile). Not server/go.mod (that is crypto v0.53.0). Includes CVE-2026-46595 (CVSS 10.0), CVE-2026-42508, CVE-2026-39830–39834 |
| 1C 5H | Go stdlib 1.26.5 | FROM golang:1.26.5-alpine3.23. Critical CVE-2026-39821; Highs CVE-2026-56862, CVE-2026-56859, CVE-2026-56853, CVE-2026-46600, CVE-2026-33818 |
| 1C 2H | golang.org/x/net 0.49.0 |
Older copy in the image (server/go.mod already has v0.56.0). CVE-2026-39821, CVE-2026-46600, CVE-2026-33814 |
| 3H | golang.org/x/crypto 0.53.0 |
server/go.mod indirect. CVE-2026-78662, CVE-2026-56855, CVE-2026-56854 |
| 2H | google.golang.org/grpc 1.82.1 |
server/go.mod. CVE-2026-84304, CVE-2026-84445 |
| 1H | github.com/gomarkdown/markdown @20260411013819-759bbc3e3207 |
server/go.mod. CVE-2023-42821 |
Scout instance totals can double-count the same CVE on two packages (e.g. CVE-2026-39821 on stdlib and x/net).
main vs this image
origin/main after v2.54.1 does not change server/go.mod or server/Dockerfile (Go 1.26.5, grpc 1.82.1, crypto v0.53.0, alpine 3.23.3, dockerize v0.10.1). Commits since the tag are UI/product changes only.
Open PR #3920 bumps grpc in server/ to 1.83.2; it is not merged and does not change Go, x/crypto, or dockerize.
References
- Image:
temporalio/ui:2.54.1 - Dockerfile:
server/Dockerfile - #3840 #3664 #3665 #1703 #3920
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with server/Dockerfile and server/go.mod, then inspect how dockerize v0.10.1 and the listed Go modules enter the built image. Rebuild temporalio/ui:2.54.1 or the updated image and run Docker Scout against the target image; done means the reported critical and high vulnerabilities are addressed and the scan results are verified.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, go
- Domain
- devops, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100