[chen21019]

Result

Fix the actual image vulnerabilities that blocked v0.9.30, retaining every scanner severity and attestation/publication gate. The previous signed tags remain immutable. This candidate targets new v0.9.31; native QA remains pending.

Finding and narrow patch boundary

The release source scan reported no module vulnerabilities, but the produced image reported 14:

• Runtime zlib 1.3.2-r0: CVE-2026-85091 (MEDIUM), fixed by Alpine 1.3.2-r1. The independent runtime stage retained the older preinstalled zlib despite the builder's updated zlib-dev. Add a direct exact runtime zlib pin and source-contract assertions.
• Controller binary Go standard library 1.27.0: 13 findings (3 HIGH, 9 MEDIUM, 1 LOW), scanner-fixed in 1.27.2. Use the current same-line security patch 1.27.3, including the newer crypto/x509 security fix; change only existing Go patch pins and matching checksums in the Dapper and three existing workflow producers. Go module/API versions and controller source are unchanged.

Official Go release history records 1.27.2 on 2026-10-08 and 1.27.3 on 2026-10-19. Official download metadata provides:

Archive	SHA256
go1.27.3.linux-amd64.tar.gz	65efbc80fdc1fa2cd2631cad5b481777a68e8725f34e89f50fc6ac714e379b40
go1.27.3.linux-arm64.tar.gz	a06e99309dbcbdca1a8ccd2282c3ee146e55930886e26b4f1193269587165f49

The official Alpine 3.24 main APKINDEX lists zlib 1.3.2-r1; the previous release image scan identifies it as the fixed package revision.

Verification and compatibility

• Reviewed all existing local compiler-install copies and both Dapper architecture checksums against official metadata; no old 1.27.0 producer pin remains in this repository.
• Inspected the separate builder/runtime stages: the new direct runtime pin forces the vulnerable preinstalled revision to upgrade without changing HAProxy's ABI or runtime protocol.
• git diff --check: PASS.
• No extra local image/toolchain build or duplicate race suite: existing CI executes the owning race/tests, source contracts, build, exact-version smoke, and image scan with the patched compiler.
• Do not claim the vulnerabilities fixed until the unchanged image scan passes on the actual new artifact. Do not claim native QA PASS.

Only eight necessary files change. No scanner version, severity, ignore list, dependency API, release identity checks, attestation, branch protection, or retry policy is changed. No other repository or QA/production runtime is touched.