From b7d7e5e04ba1bfd56d12d590d47b3aaaf8c8375b Mon Sep 17 00:00:00 2001
From: Wikid82 <176516789+Wikid82@users.noreply.github.com>
Date: Thu, 29 Oct 2026 16:25:14 +0000
Subject: [PATCH 1/3] chore(docker): refresh bundled proxy toolchain image

Rebuilds the prebuilt Caddy/CrowdSec toolchain image so the shipped
binaries pick up upstream fixes, and bumps the digest pin in the
Dockerfile.
---
 Dockerfile | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index a07d58b96..d8581ece4 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -19,8 +19,8 @@ ARG CHARON_TOOLCHAIN_IMAGE=ghcr.io/wikid82/charon-toolchain
 # NOT Renovate-tracked (a content-hash tag has no series to follow, N7) — the
 # toolchain-image.yml bot owns these two lines. DIGEST is the arch-independent
 # manifest-list (OCI index) digest, so one pin covers linux/amd64 + linux/arm64.
-ARG CHARON_TOOLCHAIN_TAG=caddy-crowdsec-beabb9a1afb75f01
-ARG CHARON_TOOLCHAIN_DIGEST=sha256:0c5a9a27132bf11b25bdf5f300c89cf02fb9ccf396c5fdbc524d7bb8afefd9b6
+ARG CHARON_TOOLCHAIN_TAG=caddy-crowdsec-ca89f6a1428729c6
+ARG CHARON_TOOLCHAIN_DIGEST=sha256:f7c7a1ca44b61401fb95dd0ec44b5216f220e86581229be42117fb7de3005837
 
 # Stage selector — default consumes the prebuilt toolchain image (no compile).
 # Fork PRs / bootstrap / offline builds pass

From fd7611f6fdf612affde88248f804482830ea7a8d Mon Sep 17 00:00:00 2001
From: Wikid82 <jhatfield82@gmail.com>
Date: Thu, 29 Oct 2026 14:44:26 -0400
Subject: [PATCH 2/3] chore: update vulnerability suppression for
 GHSA-6mp9-8xrw-74r4 in .grype.yaml and .trivyignore

---
 .grype.yaml  | 20 ++++++++++++++++++++
 .trivyignore |  9 ++++++++-
 2 files changed, 28 insertions(+), 1 deletion(-)

diff --git a/.grype.yaml b/.grype.yaml
index 58f3c705e..9863bc206 100644
--- a/.grype.yaml
+++ b/.grype.yaml
@@ -4,6 +4,17 @@
 # Documentation: https://github.com/anchore/grype#specifying-matches-to-ignore
 
 ignore:
+
+     # References:
+  # - CVE-2026-116586:
+  - vulnerability: GHSA-6mp9-8xrw-74r4
+    package:
+      name: github.com/go-jose/go-jose/v3
+      type: go-module
+    reason: |
+      HIGH — Parsing deeply nested JSON structures can hit Go's stack limit, causing the application to crash.
+    expiry: "2026-11-23"  # Review: Initial suppression 2026-09-18. Next review: 2026-10-18.
+
   # GHSA-mgcc-cww5-fp2q / CVE-2026-116587: Go JOSE: DoS when parsing JWKs that contain RSA keys
   # Severity: HIGH
   # Package: github.com/go-jose/go-jose/v3 v3.0.5 (embedded in /usr/bin/caddy)
@@ -1441,6 +1452,15 @@ ignore:
       Alpine/upstream patch.
     expiry: "2026-10-18"  # Review: Initial suppression 2026-09-18. Next review: 2026-10-18.
 
+     # References:
+  # - CVE-2026-116586:
+  - vulnerability: GHSA-6mp9-8xrw-74r4
+    package:
+      name: Go JOSE
+    reason: |
+      HIGH — Parsing deeply nested JSON structures can hit Go's stack limit, causing the application to crash.
+    expiry: "2026-11-23"  # Review: Initial suppression 2026-09-18. Next review: 2026-10-18.
+
     # Action items when this suppression expires:
     # 1. Check Alpine's zlib package tracker for a patched build past 1.3.2-r0
     # 2. If a patched package is available: rebuild Docker image, run security-scan-docker-image,
diff --git a/.trivyignore b/.trivyignore
index 9d904e4bc..74115d75d 100644
--- a/.trivyignore
+++ b/.trivyignore
@@ -327,4 +327,11 @@ CVE-2026-85091
 # No upstream fix or v3 patch available
 # Review by: 2026-11-28
 # exp: 2026-11-28
-CVE-2026-116587
\ No newline at end of file
+CVE-2026-116587
+
+# CVE-2026-116586: Go JOSE: Panics in JSON parsing 
+# Severity: HIGH
+# No upstream fix or v3 patch available
+# Review by: 2026-11-29
+# exp: 2026-11-29
+CVE-2026-116586
\ No newline at end of file

From 68d0fc01241d8eb6906e008f19cc2d254e6a77d5 Mon Sep 17 00:00:00 2001
From: Wikid82 <jhatfield82@gmail.com>
Date: Thu, 29 Oct 2026 14:48:39 -0400
Subject: [PATCH 3/3] chore: update vulnerability suppression for
 GHSA-4w3g-jfj2-cw2q

---
 .grype.yaml  | 12 ++++++++++--
 .trivyignore |  9 ++++++++-
 2 files changed, 18 insertions(+), 3 deletions(-)

diff --git a/.grype.yaml b/.grype.yaml
index 9863bc206..d90b6bdf4 100644
--- a/.grype.yaml
+++ b/.grype.yaml
@@ -5,7 +5,15 @@
 
 ignore:
 
-     # References:
+  # - CVE-2026-116585:
+  - vulnerability: GHSA-4w3g-jfj2-cw2q
+    package:
+      name: github.com/go-jose/go-jose/v3
+      type: go-module
+    reason: |
+      HIGH — Panic during CBC-HMAC processing
+    expiry: "2026-11-29"
+
   # - CVE-2026-116586:
   - vulnerability: GHSA-6mp9-8xrw-74r4
     package:
@@ -13,7 +21,7 @@ ignore:
       type: go-module
     reason: |
       HIGH — Parsing deeply nested JSON structures can hit Go's stack limit, causing the application to crash.
-    expiry: "2026-11-23"  # Review: Initial suppression 2026-09-18. Next review: 2026-10-18.
+    expiry: "2026-11-29"
 
   # GHSA-mgcc-cww5-fp2q / CVE-2026-116587: Go JOSE: DoS when parsing JWKs that contain RSA keys
   # Severity: HIGH
diff --git a/.trivyignore b/.trivyignore
index 74115d75d..d9fb8473c 100644
--- a/.trivyignore
+++ b/.trivyignore
@@ -334,4 +334,11 @@ CVE-2026-116587
 # No upstream fix or v3 patch available
 # Review by: 2026-11-29
 # exp: 2026-11-29
-CVE-2026-116586
\ No newline at end of file
+CVE-2026-116586
+
+# CVE-2026-116585: Go JOSE: Panics in JSON parsing 
+# Severity: HIGH
+# No upstream fix or v3 patch available
+# Review by: 2026-11-29
+# exp: 2026-11-29
+CVE-2026-116585
\ No newline at end of file