[AW Top 10] 07 Consolidate container image CVE burn-down work #65934

Priority 7/10 | 8 source issues | Impact 3/5 | Confidence 4/5 | Effort 3/5

One assignment, one coherent fix

The container image scan opens one burn-down issue per image, covering Node, Firewall, MCP Gateway, GitHub MCP Server, Serena, xberg and Grafana images. One dependency update pass addresses these source issues together.

Implementation scope

Triage the reported CVEs per image, bump base images and pinned versions where fixes exist, and record accepted unfixable findings with justification. Update the image pins in the repository's container configuration.

Done when

• Each listed image has fixable CVEs resolved or documented as accepted with a reason.
• A rescan shows no fixable high or critical findings remain.

Why now

Security scan findings are current and concrete, and a single dependency pass covers all of them. Impact depends on which CVEs are reachable.

Unchanged AW sources close only after this summary is completed. Newer source activity and not-planned retirement do not trigger source closure. Assigned summaries are frozen; unassign to allow reclustering.

Generated by AW Essential Issue Clustering · copilot · auto · 32 AIC · ⌖ 11.2 AIC · ⊞ 8.9K · ◷