Package
docker-credential-acr-env-fips
Component
github.com/chrismellard/docker-credential-acr-env
Latest update
Fixed version
0.7.0-r33
Aliases
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Fixed version
0.7.0-r33Impact
GO-2026-6225 fixed: this package is now built from the patched helper that the EmeritOSS kaniko fork carries in-tree (chainguard-forks/kaniko v1.25.20, third_party/docker-credential-acr-env), which anchors the ACR hostname check; the github.com/chrismellard/docker-credential-acr-env module is gone from the binary build info (stereo#410885 / stereo#410888, OS-5364, ProdSec review PSEC-4801). The 2026-08-19 false-positive determination on this advisory was an automated govulncheck call on a stripped binary; the standalone helper executes the vulnerable Get path for any host handed to it via a global credsStore, so it was a true positive until this fix.
Status
Justification
Impact
Govulncheck found no affected symbols in the scanned Go binary.
Status