[janishorsts]

EarthBuild/earthbuild#1000

_{Stack created with GitHub Stacks CLI • Give Feedback 💬}

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Commit to this branch
• Create a new PR

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	golang/​github.com/​docker/​docker@​v25.0.3+incompatible
	golang/​golang.org/​x/​crypto@​v0.21.0
	golang/​google.golang.org/​grpc@​v1.59.0
	golang/​github.com/​google/​shlex@​v0.0.0-20191202100458-e7afc7fbc510
	golang/​github.com/​hashicorp/​go-cleanhttp@​v0.5.2
	golang/​github.com/​hashicorp/​go-immutable-radix@​v1.3.1
	golang/​github.com/​hashicorp/​go-multierror@​v1.1.1
	golang/​github.com/​hashicorp/​golang-lru@​v0.5.4
	golang/​github.com/​opencontainers/​go-digest@​v1.0.0
	golang/​github.com/​spdx/​tools-golang@​v0.5.3
	golang/​kernel.org/​pub/​linux/​libs/​security/​libcap/​cap@​v1.2.67
	golang/​github.com/​containerd/​stargz-snapshotter@​v0.15.1
	golang/​github.com/​aws/​aws-sdk-go-v2@​v1.24.1
	golang/​github.com/​containernetworking/​plugins@​v1.4.0
	golang/​github.com/​docker/​distribution@​v2.8.2+incompatible
	golang/​github.com/​containerd/​containerd@​v1.7.13
	golang/​github.com/​containerd/​nydus-snapshotter@​v0.13.7
	golang/​go.opentelemetry.io/​otel@​v1.21.0
	golang/​github.com/​docker/​cli@​v25.0.3+incompatible
	golang/​github.com/​Microsoft/​hcsshim@​v0.11.4
	golang/​golang.org/​x/​net@​v0.23.0
	golang/​google.golang.org/​protobuf@​v1.31.0
	golang/​github.com/​agext/​levenshtein@​v1.2.3
	golang/​github.com/​armon/​circbuf@​v0.0.0-20190214190532-5111143e8da2
	golang/​github.com/​gogo/​googleapis@​v1.4.1
	golang/​github.com/​gogo/​protobuf@​v1.3.2
	golang/​github.com/​mitchellh/​hashstructure/​v2@​v2.0.2
	golang/​github.com/​moby/​locker@​v1.0.1
	golang/​github.com/​pkg/​errors@​v0.9.1
	golang/​github.com/​serialx/​hashring@​v0.0.0-20200727003509-22c0c7ab6b1b
	golang/​github.com/​tonistiigi/​units@​v0.0.0-20180711220420-6950e57a87ea
	golang/​github.com/​vishvananda/​netlink@​v1.2.1-beta.2
See 67 more rows in the dashboard

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Priority	Alert  (click "▶" to expand/collapse)	Action
	Critical CVE: Authz zero length regression in golang github.com/docker/docker CVE: GHSA-v23v-6jw2-98fq Authz zero length regression (CRITICAL) Affected versions: >= 19.03.0 < 23.0.15; >= 26.0.0 < 26.1.5; >= 27.0.0 < 27.1.1; >= 24.0.0 < 25.0.6 Patched version: 25.0.6 From: go.mod → golang/github.com/docker/docker@v25.0.3+incompatible ℹ Read more on: This package | This alert | What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore golang/github.com/docker/docker@v25.0.3+incompatible. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Critical CVE: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang golang.org/x/crypto CVE: GHSA-v778-237x-gjrc Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto (CRITICAL) Affected versions: < 0.31.0 Patched version: 0.31.0 From: go.mod → golang/golang.org/x/crypto@v0.21.0 ℹ Read more on: This package | This alert | What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore golang/golang.org/x/crypto@v0.21.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Critical CVE: golang golang.org/x/crypto: Invoking client can cause server deadlock on unexpected responses CVE: GHSA-vgwf-h737-ff37 golang.org/x/crypto: Invoking client can cause server deadlock on unexpected responses (CRITICAL) Affected versions: < 0.52.0 Patched version: 0.52.0 From: go.mod → golang/golang.org/x/crypto@v0.21.0 ℹ Read more on: This package | This alert | What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore golang/golang.org/x/crypto@v0.21.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Critical CVE: golang golang.org/x/crypto doesn't drop invoking agent constraints when forwarding keys CVE: GHSA-f5wc-c3c7-36mc golang.org/x/crypto doesn't drop invoking agent constraints when forwarding keys (CRITICAL) Affected versions: < 0.52.0 Patched version: 0.52.0 From: go.mod → golang/golang.org/x/crypto@v0.21.0 ℹ Read more on: This package | This alert | What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore golang/golang.org/x/crypto@v0.21.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Critical CVE: golang golang.org/x/crypto vulnerable to infinite loop on large channel writes CVE: GHSA-rm3j-f69w-wqmq golang.org/x/crypto vulnerable to infinite loop on large channel writes (CRITICAL) Affected versions: < 0.52.0 Patched version: 0.52.0 From: go.mod → golang/golang.org/x/crypto@v0.21.0 ℹ Read more on: This package | This alert | What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore golang/golang.org/x/crypto@v0.21.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Critical CVE: golang golang.org/x/crypto vulnerable to auth bypass via unenforced @Revoked status CVE: GHSA-5cgq-3rg8-m6cv golang.org/x/crypto vulnerable to auth bypass via unenforced @revoked status (CRITICAL) Affected versions: < 0.52.0 Patched version: 0.52.0 From: go.mod → golang/golang.org/x/crypto@v0.21.0 ℹ Read more on: This package | This alert | What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore golang/golang.org/x/crypto@v0.21.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Critical CVE: golang golang.org/x/crypto: FIDO/U2F security key physical presence check can be bypassed CVE: GHSA-89gr-r52h-f8rx golang.org/x/crypto: FIDO/U2F security key physical presence check can be bypassed (CRITICAL) Affected versions: < 0.52.0 Patched version: 0.52.0 From: go.mod → golang/golang.org/x/crypto@v0.21.0 ℹ Read more on: This package | This alert | What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore golang/golang.org/x/crypto@v0.21.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Critical CVE: golang golang.org/x/crypto: Invoking VerifiedPublicKeyCallback permissions skip enforcement CVE: GHSA-x527-x647-q7gg golang.org/x/crypto: Invoking VerifiedPublicKeyCallback permissions skip enforcement (CRITICAL) Affected versions: < 0.52.0 Patched version: 0.52.0 From: go.mod → golang/golang.org/x/crypto@v0.21.0 ℹ Read more on: This package | This alert | What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore golang/golang.org/x/crypto@v0.21.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Critical CVE: golang golang.org/x/crypto doesn't enforce invoking key constraints CVE: GHSA-jppx-rxg9-jmrx golang.org/x/crypto doesn't enforce invoking key constraints (CRITICAL) Affected versions: < 0.52.0 Patched version: 0.52.0 From: go.mod → golang/golang.org/x/crypto@v0.21.0 ℹ Read more on: This package | This alert | What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore golang/golang.org/x/crypto@v0.21.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Critical CVE: gRPC-Go has an authorization bypass via missing leading slash in :path in golang google.golang.org/grpc CVE: GHSA-p77j-4mvh-x3m3 gRPC-Go has an authorization bypass via missing leading slash in :path (CRITICAL) Affected versions: < 1.79.3 Patched version: 1.79.3 From: go.mod → golang/google.golang.org/grpc@v1.59.0 ℹ Read more on: This package | This alert | What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore golang/google.golang.org/grpc@v1.59.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn

View full report

[github-actions]

🎉 Are we earthbuild yet?

Great progress! You've reduced "earthly" occurrences by 10 (4.57%)

📈 Overall Progress

Branch	Total Count
main	219
This PR	209
Difference	-10 (4.57%)

📁 Changes by file type:

File Type	Change
Go files (.go)	✅ -9
Documentation (.md)	➖ No change
Earthfiles	➖ No change

---

Keep up the great work migrating from Earthly to Earthbuild! 🚀

💡 Tips for finding more occurrences

Run locally to see detailed breakdown:

./.github/scripts/count-earthly.sh

Note that the goal is not to reach 0.
There is anticipated to be at least some occurences of earthly in the source code due to backwards compatibility with config files and language constructs.