Binary builds on stackstate-7.78.2 started failing on 2026-08-19 with one unmanaged finding on the cluster-agent image (both amd64 and arm64):
CVE-2026-73500 HIGH go.etcd.io/etcd/client/pkg/v3@v3.6.5 [grype]
The 2026-08-18 20:25 scheduled build on the same base commit (f7ef51092) passed, so this is a newly published advisory rather than a code regression.
Advisory: tlsListener.acceptLoop spawns unbounded handshake goroutines with no deadline. Fixed in 3.6.14 for the 3.6 line (also 3.5.33 and 3.7.1).
Remediation: bump the three indirect go.etcd.io/etcd modules from v3.6.5 to v3.6.14 — a patch-level move inside the same minor line:
go.etcd.io/etcd/api/v3go.etcd.io/etcd/client/pkg/v3go.etcd.io/etcd/client/v3
Impact: blocks every PR targeting stackstate-7.78.2 until the base branch is fixed, currently including #458.
Binary buildsonstackstate-7.78.2started failing on 2026-08-19 with one unmanaged finding on the cluster-agent image (both amd64 and arm64):The 2026-08-18 20:25 scheduled build on the same base commit (
f7ef51092) passed, so this is a newly published advisory rather than a code regression.Advisory:
tlsListener.acceptLoopspawns unbounded handshake goroutines with no deadline. Fixed in 3.6.14 for the 3.6 line (also 3.5.33 and 3.7.1).Remediation: bump the three indirect
go.etcd.io/etcdmodules fromv3.6.5tov3.6.14— a patch-level move inside the same minor line:go.etcd.io/etcd/api/v3go.etcd.io/etcd/client/pkg/v3go.etcd.io/etcd/client/v3Impact: blocks every PR targeting
stackstate-7.78.2until the base branch is fixed, currently including #458.