snyk-cli/1.1295.4-r0: cve remediation

[octo-sts]

snyk-cli/1.1295.4-r0: fix CVE-2025-22868

Advisory data: https://github.com/wolfi-dev/advisories/blob/main/snyk-cli.advisories.yaml

Source code for this service: https://go/cve-remedy-automation-source

Logs for this execution: https://go/cve-remedy-automation-logs

Docs for this service: (not provided yet)

[octo-sts]

⚠️ EXPERIMENTAL

Please use 👍 or 👎 on this comment to indicate if you agree or disagree with the recommendation.

To provide more detailed feedback please comment on the recommendation prefixed with /ai-verify:

e.g. /ai-verify partially helpful but I also added bash to the build environment

Gen AI suggestions to solve the build error:

Based on the build error output, I'll analyze and provide specific fixes:

• Detected Error: git clone --quiet --origin=origin --config=user.name=Melange Build --config=user.email=melange-build@cgr.dev --config=advice.detachedHead=false --branch=v1.1295.4 --depth=1 https://github.com/snyk/cli /tmp/tmp.rDYeWh
(The command failed silently, indicating a tag/branch issue)

• Error Category: Version/Git Checkout

• Failure Point: git-checkout pipeline step

• Root Cause Analysis: The build is failing because the git-checkout step is trying to clone using -b v1.1295.4 which attempts to treat the tag as a branch. This is incorrect for tag checkouts.

• Suggested Fix:
Modify the git-checkout step in the melange YAML to:

  - uses: git-checkout
    with:
      repository: https://github.com/snyk/cli
      ref: v${{package.version}}
      expected-commit: b1e2445578abbb425a96611e4e58ff8057329e82

• Explanation:

• The current configuration uses tag: which forces git to try checking out the tag as a branch
• Using ref: instead allows git to properly resolve both tags and branches
• This matches how the upstream repository tags their releases

• Additional Notes:

• Verify the expected-commit hash matches the v1.1295.4 tag
• The tag format matches the upstream convention (v prefix)
• This is a common issue when working with repositories that use tagged releases

• References:

• Melange git-checkout documentation: https://github.com/chainguard-dev/melange/blob/main/docs/reference/pipeline.md#git-checkout
• Snyk CLI releases: https://github.com/snyk/cli/releases