Hi, I have a dockerfile that creates image for pulumi automation app

FROM <http://mcr.microsoft.com/dotnet/sdk:9.0|mcr.microsoft.com/dotnet/sdk:9.0> AS installer-env

COPY . /src/dotnet-function-app
WORKDIR /src/dotnet-function-app/src

RUN mkdir -p /home/site/wwwroot && \
dotnet publish xxx --output /home/site/wwwroot

FROM <http://mcr.microsoft.com/azure-functions/dotnet-isolated:4-dotnet-isolated9.0|mcr.microsoft.com/azure-functions/dotnet-isolated:4-dotnet-isolated9.0>

RUN apt-get update \
    && apt-get install -y --no-install-recommends curl \
    && apt-get install -y azure-cli \
    && curl -fsSL <https://get.pulumi.com> | sh \
    && rm -f /home/.pulumi/bin/pulumi-language-yaml \
    && rm -f /home/.pulumi/bin/pulumi-language-java \
    && apt-get purge -y curl \
    && apt-get autoremove -y \
    && apt-get clean \
    && rm -rf /var/lib/apt/lists/*

ENV PATH="/home/.pulumi/bin:$PATH"

ENV AzureWebJobsScriptRoot=/home/site/wwwroot \
    AzureFunctionsJobHost__Logging__Console__IsEnabled=true

RUN pulumi plugin install resource azure v6.24.0 --exact \
    && pulumi plugin install resource azure-native v3.14.0 --exact 

COPY --from=installer-env ["/home/site/wwwroot", "/home/site/wwwroot"]

Some lines are to mitigate CVEs in pulumi but I still see in scanners CVE-2025-68121 home/.pulumi/bin/pulumi-language-dotnet stdlib 1.24.12. After some conversation with claude it suggests it needs to be fixed on pulumi side. Do you know any walkaround or do you plan to fix that vuln? AI suggests it's in golang version which pulumi is built against.

heya - v3.224.0 should include the relevant bits to address this!

Hi, the issue is still active https://pulumi-community.slack.com/archives/C84L4E3N1/p1772190191941679?thread_ts=1771958542.104479&cid=C84L4E3N1

odd, looks like dotnet at least should be building with Go 1.26 now

Hm, is it safe to say that in context of using Automation API? I mean theoretically can stdlib "leak" and be used in context of our dotnet app, or is it bundled inside pulumi?

its bundled inside pulumi, there's no risk of this leaking and we don't use TLS inside the dotnet plugin. azure probably does I don't know the codebase that well, but I'm not sure if its vulnerable to this particular exploit.

Apologies for speaking too early there @quick-noon-18541 Out of personal curiosity, do you mind sharing which tool those screenshots are from?

It's aquasec. I checked if I really build image on latest pulumi version and it looks like it's the previous one (3.223). I try to build on newest version

There's a pipeline that needs to run to update pulumi.com after the github release, it doesn't always run right away

I guess it's this PR Regen docs pulumi@3.224.0 by pulumi-bot · Pull Request #17714 · pulumi/docs. Is it merged automatically or someone needs to push that?

Manually I think but it's done now