buck2/20250401-r2: cve remediation

[octo-sts]

buck2/20250401-r2: fix GHSA-qx2v-8332-m4fv

Advisory data: https://github.com/wolfi-dev/advisories/blob/main/buck2.advisories.yaml

---

"Breadcrumbs" for this automated service

• Source Code: https://go/cve-remedy-automation-source
• Logs: https://go/cve-remedy-automation-logs
• Docs: (not provided yet)

[octo-sts]

📦 Build Failed: Missing Dependency

Error: failed reading file: open Cargo.lock: no such file or directory

Build Details

Category	Details
Build System	melange/rust/cargo
Failure Point	rust/cargobump pipeline step - cargobump command execution

Root Cause Analysis 🔍

The cargobump tool is attempting to read a Cargo.lock file that does not exist in the current directory. This suggests either the Cargo.lock file was not generated during the initial cargo setup, or the working directory is incorrect when cargobump is executed. The build system expects this file to exist for dependency management but it's missing from the source checkout.

---

Was this comment helpful? Please use 👍 or 👎 reactions on this comment.

[dnegreira]

malscan is clean

user@david-negreira:~/packages/buck2$ ~/git/image-fulfillment-sandbox/amber.arcadia/download-presubmit-packages.sh --malc https://apk.cgr.dev/wolfi-presubmit/61863e77ab723cefbb5a730d59eefacdea9d70a4
Downloading "https://apk.cgr.dev/wolfi-presubmit/61863e77ab723cefbb5a730d59eefacdea9d70a4/aarch64/buck2-20250401-r3.apk" to "buck2-20250401-r3-aarch64.apk"
Downloading "https://apk.cgr.dev/wolfi-presubmit/61863e77ab723cefbb5a730d59eefacdea9d70a4/x86_64/buck2-20250401-r3.apk" to "buck2-20250401-r3-x86_64.apk"
Waiting for downloads to finish...
All downloads complete.
Scanning downloaded APKs with malcontent...
🔎 Scanning "/work/buck2-20250401-r3-aarch64.apk"
🔎 Scanning "/work/buck2-20250401-r3-x86_64.apk"
Malcontent scan complete.
[1m 4.827s] --> [0]