Description

sparshahuja20

opened on Oct 22, 2026

Issue body actions

The published feastdev/go-feature-server image (tag 0.63.0) ships an outdated linux-libc-dev package in its Debian base layer. The package is flagged by container vulnerability scanners for four Debian Security Advisories.

Because linux-libc-dev is inherited from the base image and not installed by a consumer's Dockerfile, downstream users cannot remediate it on their side.

Affected image

• quay.io/feastdev/go-feature-server:0.63.0
• Digest: sha256:c0061802d1a132c7fedc4ef52e1d36d2f1c5f3b21ba054900deba5053fc08283
• Vulnerable package: linux-libc-dev (Debian kernel headers, from the base image)

Advisories detected

Advisory	Fixed version (linux-libc-dev ≥)
DSA-6238-1	6.12.85-1
DSA-6253-1	6.12.86-1
DSA-6274-1	6.12.88-1
DSA-6295-1	6.12.90-1

Steps to reproduce

1. Pull feastdev/go-feature-server:0.63.0.
2. Inspect the installed package version:

   docker run --rm feastdev/go-feature-server:0.63.0 dpkg -s linux-libc-dev | grep Version

3. Observe that the version is below 6.12.90-1 and is flagged by scanners (Trivy/Grype/Aqua) against the advisories above.

Expected behavior

The published image scans clean against DSA-6238-1, DSA-6253-1, DSA-6274-1, and DSA-6295-1.

Environment

• Feast version: 0.63.0
• Image: feastdev/go-feature-server:0.63.0

Activity

1. shyamaryan commented on Oct 23, 2026

   

   shyamaryan

   on Oct 23, 2026

   More actions

   @shuchu can you pls help fix this?

   Reacted by Shuchu Han
2. shuchu

   closed this as completedin #7066on Oct 25, 2026
3. odh-devops-app

   added a commit that references this issue on Oct 25, 2026

   fix: Build the Go feature server image in two stages

   This issue will close once commit 1e5e90c is merged into the 'master' branch.

   1e5e90c
4. shyamaryan commented on Oct 30, 2026

   

   shyamaryan

   on Oct 30, 2026

   More actions

   @shuchu @NopeCharon Thanks for fixing this!
   I found out another vulnerability on Feast 0.67.0 go-feature-server image :
   DSA-6582-1 is a critical Debian Security Advisory released on October 23, 2026, addressing a major vulnerability in the brotli compression suite.
5. shyamaryan commented on Oct 30, 2026

   

   shyamaryan

   on Oct 30, 2026

   More actions

   5. @shuchu @NopeCharon Thanks for fixing this!
   I found out another vulnerability on Feast 0.67.0 go-feature-server image :
   DSA-6582-1 is a critical Debian Security Advisory released on October 23, 2026, addressing a major vulnerability in the brotli compression suite.

   Raised an issue on this - #7094
6. aniketpalu

   added a commit that references this issue on Oct 30, 2026

   fix: Build the Go feature server image in two stages

   This issue will close once commit f2a24f5 is merged into the 'master' branch.

   f2a24f5
7. franciscojavierarceo

   added a commit that references this issue on Nov 10, 2026

   chore(release): release 0.68.0

   fb5e5d5
8. shuchu

   added a commit that references this issue on Nov 11, 2026

   chore(release): release 0.68.0

   5b94c9e

Issue actions