Update to gosu 1.20 (moby/sys/user v0.4.1, GO-2026-6686)
Nobody has claimed this yet.
Assessment
- Difficulty
- 1/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 80/100
Research direction
The issue names 17/alpine3.23/Dockerfile as an example and says the current images set GOSU_VERSION to 1.19. Start by checking that version and the earlier release bump in #1201, then find the corresponding version declarations across the image directories. Update them to gosu 1.20 and check that the image definitions consistently use the requested release.
Written by the indexing model from the issue text.
Description
gosu 1.20 was released on 2026-10-25 (https://github.com/tianon/gosu/releases/tag/1.20). The current images still set ENV GOSU_VERSION 1.19, for example 17/alpine3.23/Dockerfile.
gosu 1.19 links github.com/moby/sys/user v0.1.0, which is affected by GO-2026-6686 / CVE-2026-61801 (possible denial of service through unbounded parsing of user and group database files, fixed in v0.4.1). 1.20 links v0.4.1.
govulncheck v1.9.0 in binary mode on the linux/arm64 binaries:
| gosu 1.19 | gosu 1.20 | |
|---|---|---|
moby/sys/user |
v0.1.0 | v0.4.1 |
| GO-2026-6686 | reported, with symbols GetExecUser, GetExecUserPath, ParseGroupFilter |
not reported |
gosu does call this code at container start through GetExecUserPath. On the files the image ships, root-owned and read at start-up, I see no practical attack, so this is not a report of an exploitable issue in these images. It is a request to pick up a release that already exists.
Would you take gosu 1.20, as was done for earlier gosu releases (for example #1201)? Both binaries are built with Go 1.24.6, so this does not change the Go standard library findings scanners report. #1304 and #1350 are about those and about replacing gosu; this request is only the version bump.
- Dominant language
- Shell
- Stars
- 2.5k
- Forks
- 1.2k
- PR merge metrics
- No merged PRs in 30d
Getting set up
This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from docker-library/postgres
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
docker-library/postgres#1427 ·
-
Difficulty 4/5 3-5 days Newbie friendliness 48/100
docker-library/postgres#1420 ·
-
Difficulty 4/5 3-5 days Newbie friendliness 48/100
docker-library/postgres#1419 · 2 comments ·
-
Difficulty 4/5 3-5 days Newbie friendliness 35/100
docker-library/postgres#1389 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 35/100
docker-library/postgres#1356 · 5 comments · 7 reactions ·
All issues in docker-library/postgres
Similar issues
-
Difficulty 1/5 Under an hour Newbie friendliness 82/100
-
Difficulty 1/5 Under an hour Newbie friendliness 72/100
raetha/wyzesense2mqtt#116 ·
-
Difficulty 1/5 Under an hour Newbie friendliness 62/100
-
enhancement
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
catppuccin/tmux#608 ·
-
area:linux source:reader type:content-error
Difficulty 1/5 Under an hour Newbie friendliness 72/100
stephrobert/blog-roadmap#185 ·