Package
gitlab-rails-ce-18.9
Component
github.com/distribution/distribution/v3
Latest update
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Impact
github.com/distribution/distribution/v3 is bundled as a transitive Go dependency in gitlab-rails-ce's Rebuild devfile pipeline step. The GHSA-6pjf-3r9x-m592 fix is in distribution/v3 v3.1.1, but v3.1.x extracted the reference subpackage into a separate module (github.com/distribution/reference v0.6.0). The bundled github.com/devfile/library/v2 still imports github.com/distribution/distribution/v3/reference at the old path — bumping just distribution/v3 fails the build with 'module github.com/distribution/distribution/v3@v3.1.1 ... does not contain package github.com/distribution/distribution/v3/reference'. Resolving requires upstream devfile-library to update its imports to the new module path. Tracking upstream.
Status