debian-archive-keyring@2025.1 (GPL-2.0-or-later)
fontconfig@2.15.0-2.3 (HPND-sell-variant)
fonts-dejavu-mono@2.37-8 (GPL-2.0-only, GPL-2.0-or-later, Bitstream-Vera)
gcc-14-base@14.2.0-19 (BSD-4-Clause-UC, GPL-3.0-or-later, HPND, LGPL-2.0-or-later, LGPL-2.1-or-later, NCSA, Spencer-94, Unicode-DFS-2015, Zlib)
libaom3@3.12.1-1+deb13u1 (Expat, public-domain-md5)
libapt-pkg7.0@3.0.3 (Expat, GPL-2.0-only, GPL-2.0-or-later, curl)
libarchive13t64@3.7.4-4+deb13u1 (BSD-1-clause-UCB, BSD-124-clause-UCB, BSD-3-clause-UCB, BSD-4-clause-UCB, CC0-1.0, Expat, OpenSSL+SSLeay, PD)
libatomic1@14.2.0-19 (BSD-4-Clause-UC, GPL-3.0-or-later, HPND, LGPL-2.0-or-later, LGPL-2.1-or-later, NCSA, Spencer-94, Unicode-DFS-2015, Zlib)
libcurl4t64@8.14.1-2+deb13u5 (BSD-4-Clause-UC, FSFULLR, GPL-2.0-only, GPL-2.0-or-later, GPL-3.0-or-later, OLDAP-2.8, X11, curl)
libdatrie1@0.2.13-3+b1 (GPL-2.0-only, GPL-2.0-or-later, LGPL-2.1-only, LGPL-2.1-or-later)
libdav1d7@1.5.1-1 (public-domain)
libdb5.3t64@5.3.28+dfsg2-9 (Artistic, BSD-3-clause-fjord, GPL, GPL-3.0-only, MIT-old, MS-PL, Sleepycat, TCL-like, X11, Zlib)
libde265-0@1.0.15-1+deb13u2 (BSD-4-Clause, GPL-3.0-only, GPL-3.0-or-later, LGPL-3.0-only, LGPL-3.0-or-later, other-1, public-domain-1)
libdebconfclient0@0.280 (GPL-2.0-only, GPL-2.0-or-later)
libffi8@3.4.8-2 (Expat, GPL, GPL-2.0-or-later, GPL-3.0-or-later, MPL-1.1, X11, public-domain)
libfribidi0@1.0.16-1 (LGPL-2.1-only, LGPL-2.1-or-later)
libglib2.0-0t64@2.84.4-3~deb13u5 (AFL-2.0, CC-BY-SA-3.0, CC0-1.0, Expat, FSFULLR, GPL-2.0-only, GPL-2.0-or-later, Iconv-PD, Janik-permissive, Kuchling-PD, LGPL-2.0-only,
libgnutls30t64@3.8.9-3+deb13u4 (CC0-1.0, FSFAP, GPL-3.0-or-later, LGPL-2.1-or-later)
libgomp1@14.2.0-19 (BSD-4-Clause-UC, GPL-3.0-or-later, HPND, LGPL-2.0-or-later, LGPL-2.1-or-later, NCSA, Spencer-94, Unicode-DFS-2015, Zlib)
libgraphite2-3@1.3.14-2+deb13u1 (Artistic, GPL-1.0-only, GPL-1.0-or-later, GPL-2.0-only, GPL-2.0-or-later, LGPL-2.1-only, LGPL-2.1-or-later, MPL-1.1, custom-sil-open-font
libharfbuzz0b@10.2.0-1+deb13u1 (CC0-1.0, Expat, FSFAP, FSFUL, FSFULLR, GPL-2.0-only, GPL-2.0-or-later, GPL-3.0-only, GPL-3.0-or-later, LGPL-2.1-only, LGPL-2.1-or-later, M
libhogweed6t64@3.10.1-1 (Expat, GAP, GPL, GPL-2.0-only, GPL-2.0-or-later, GPL-3.0-or-later, LGPL, LGPL-2.0-only, LGPL-2.0-or-later, LGPL-3.0-or-later, public-domain)
libicu76@76.1-4 (GPL-3.0-only)
libjpeg62-turbo@1:2.1.5-4 (BSD-BY-LC-NE, Expat, NTP, Zlib)
liblastlog2-2@2.41.5-0+deb13u1 (BSD-4-Clause, BSLA, Expat, GPL-2.0-only, GPL-2.0-or-later, GPL-3.0-only, GPL-3.0-or-later, LGPL, LGPL-2.0-only, LGPL-2.0-or-later, LGPL-2.
libldap2@2.6.10+dfsg-1 (BSD-3-clause-California, BSD-3-clause-variant, BSD-4-clause-California, Beerware, Expat, Expat-ISC, Expat-UNM, F5, FSF-unlimited, GPL-2.0-only, GP
libnettle8t64@3.10.1-1 (Expat, GAP, GPL, GPL-2.0-only, GPL-2.0-or-later, GPL-3.0-or-later, LGPL, LGPL-2.0-only, LGPL-2.0-or-later, LGPL-3.0-or-later, public-domain)
libnghttp3-9@1.8.0-1 (FSFAP, FSFUL, FSFULLR, GPL-2.0-only, GPL-2.0-or-later, GPL-3.0-only, GPL-3.0-or-later)
libnuma1@2.0.19-1 (GPL-2.0-or-later)
libopenjp2-7@2.5.3-2.1~deb13u2 (BSD-2, BSD-3, Libpng, libtiff, LIBTIFF-GLARSON, LIBTIFF-PIXAR, Zlib)
libpango-1.0-0@1.56.3-1 (Bitstream-Vera, Chromium-BSD-style, Example, ICU, LGPL-2.0-only, LGPL-2.0-or-later, LGPL-2.1-only, LGPL-2.1-or-later, OFL-1.1, TCL, Unicode)
libpangocairo-1.0-0@1.56.3-1 (Bitstream-Vera, Chromium-BSD-style, Example, ICU, LGPL-2.0-only, LGPL-2.0-or-later, LGPL-2.1-only, LGPL-2.1-or-later, OFL-1.1, TCL, Unicode)
libpangoft2-1.0-0@1.56.3-1 (Bitstream-Vera, Chromium-BSD-style, Example, ICU, LGPL-2.0-only, LGPL-2.0-or-later, LGPL-2.1-only, LGPL-2.1-or-later, OFL-1.1, TCL, Unicode)
libpcre2-8-0@10.46-1~deb13u3 (BSD-3-clause-Cambridge, X11, public-domain)
libpng16-16t64@1.6.48-1+deb13u6 (BSD-like-with-advertising-clause, GPL-2.0-only, GPL-2.0-or-later, expat, Libpng)
libpsl5t64@0.21.2-1.1+b1 (Chromium, gnulib)
libssh2-1t64@1.11.1-1+deb13u2 (BSD3)
libssl3t64@3.5.7-1~deb13u3 (Artistic, GPL-1.0-only, GPL-1.0-or-later)
libthai-data@0.1.29-2 (GPL-2.0-only, GPL-2.0-or-later, LGPL-2.1-only, LGPL-2.1-or-later)
libthai0@0.1.29-2+b1 (GPL-2.0-only, GPL-2.0-or-later, LGPL-2.1-only, LGPL-2.1-or-later)
libtiff6@4.7.0-3+deb13u3 (Hylafax)
libunistring5@1.3-2 (FreeSoftware, GFDL-1.2-or-later, GFDL-1.3-or-later, GPL-2.0-only, GPL-2.0-or-later, GPL-3.0-only, GPL-3.0-or-later, LGPL-2.0-only, LGPL-2.0-or-later,
libx265-215@4.1-2 (Expat, GPL-2.0-only, GPL-2.0-or-later, LGPL-2.1-only, LGPL-2.1-or-later)
login.defs@1:4.17.4-2 (GPL-1.0-only, GPL-2.0-only, GPL-2.0-or-later)
openssl-provider-legacy@3.5.7-1~deb13u3 (Artistic, GPL-1.0-only, GPL-1.0-or-later)
sqv@1.3.0-3+b2 (LGPL-2.0-only, LGPL-2.0-or-later)
tini@0.19.0-3+b8 (Expat)
xberg scan summary
Status: Upstream (third-party
xberg-io/xberg). Unique finding rows: 18 Critical, 107 High, 78 Medium, 16 Low, 1 Unknown; 47 license violations.Note: this run refreshed the pin to
ghcr.io/xberg-io/xberg:1.3.6@sha256:f1e23c634efc289b36370bb25392e7e4fa64b656e365fae3f263f24b782c4e2e, but Grype scanned@sha256:f8dd1d18...(below). The Syft SBOM step failed for this image (registry connection reset while fetching a layer), so these results may be incomplete or stale for the new digest.Images
ghcr.io/xberg-io/xberg:1.3.6@sha256:f8dd1d18b97a883b235b70ca3765b9e526cf5436764a89b6401a5d32ab96ada9(scanned by Grype)Findings by severity
Critical
High
Medium
Low
Unknown
Rejected/unknown licenses: xberg_io (47 packages)
Remediation and SLA
gh aw compile --force-refresh-container-pins, so a pin-refresh PR is the default remediation step.github/gh-aw; a code-level fix cannot land here. Do not request a local patch PR. The daily pin refresh picks up upstream fixes once released.pkg@installed => fixedlist the fixed package version reported by Grype. The image release/digest containing each fix has not been confirmed from this scan; rows with no fix listed have no fixed package version reported.ID pkg@versionentries from the scan.