Skip to content

Update circl to 1.6.3 - #52129

Merged
thaJeztah merged 1 commit into
moby:masterfrom
Nordix:fix/circl_update
Mar 3, 2026
Merged

Update circl to 1.6.3#52129
thaJeztah merged 1 commit into
moby:masterfrom
Nordix:fix/circl_update

Conversation

@ivonaest

@ivonaest ivonaest commented Mar 3, 2026

Copy link
Copy Markdown

circl library from v1.6.1 to v1.6.3 to fix a LOW severity security vulnerability.

Summary

  1. Why:
    To remove CVEs:

  2. What:

Additional evidence

Partial output from security scanner Trivy:
cve moby circl

Categorization

  • security/CVE
Signed-off-by: ivonaest <ivona.cvije@est.tech>
@thaJeztah

Copy link
Copy Markdown
Member

Yeah, won't harm to update it; if scanners find this, it's a false positive though, because the impacted package (ecc/p384, see cloudflare/circl#583) is not used; you can see that it's not included in our vendor/; https://github.com/moby/moby/tree/372ba7c366d79be0a154bdff4f09391d9c2201cd/vendor/github.com/cloudflare/circl/ecc

@thaJeztah thaJeztah added this to the 29.3.0 milestone Mar 3, 2026

@thaJeztah thaJeztah left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@thaJeztah
thaJeztah merged commit 529fabb into moby:master Mar 3, 2026
238 of 241 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

2 participants