fix: remove docker.io/mcp/brave-search — Critical/High CVEs, no upstream fix available - #48561
Merged
pelikhan merged 3 commits intoJul 28, 2026
Conversation
#48546) Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Copilot
AI
changed the title
[WIP] Fix vulnerabilities in docker.io/mcp/brave-search
fix: remove docker.io/mcp/brave-search — Critical/High CVEs, no upstream fix available
Jul 28, 2026
Collaborator
|
@copilot remove agentic workflow as well |
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Contributor
Author
Done in 06c0c73. Removed |
pelikhan
marked this pull request as ready for review
July 28, 2026 10:07
pelikhan
deleted the
copilot/container-image-scan-fix-vulnerabilities-one-more-time
branch
July 28, 2026 10:07
Contributor
There was a problem hiding this comment.
Pull request overview
Removes the vulnerable Brave Search MCP container and disables all dependent workflows and routing.
Changes:
- Removes Brave Search container pins.
- Deletes the Brave workflow and removes inspector integration.
- Regenerates workflow metadata, routing, and documentation.
Show a summary per file
| File | Description |
|---|---|
pkg/workflow/data/action_pins.json |
Removes the container pin. |
pkg/actionpins/data/action_pins.json |
Removes the embedded pin. |
docs/src/content/docs/agent-factory-status.mdx |
Removes the Brave agent listing. |
.github/workflows/shared/mcp/brave.md |
Replaces configuration with a security notice. |
.github/workflows/mcp-inspector.md |
Excludes Brave MCP. |
.github/workflows/mcp-inspector.lock.yml |
Regenerates the inspector workflow. |
.github/workflows/brave.md |
Deletes the Brave agent source. |
.github/workflows/brave.lock.yml |
Deletes its compiled workflow. |
.github/workflows/agentic_commands.yml |
Removes /brave routing. |
.github/aw/actions-lock.json |
Removes the canonical pin. |
.changeset/patch-remove-brave-search-vulnerable-image.md |
Adds release notes. |
Review details
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 10/11 changed files
- Comments generated: 2
- Review effort level: Medium
| # Brave Search MCP Server | ||
| # SECURITY: docker.io/mcp/brave-search has Critical/High CVEs with no upstream fix available (issue #48546). | ||
| # The container definition has been removed until a patched image is published upstream. | ||
| # To re-enable, restore the mcp-servers block and update the pinned digest in actions-lock.json. |
|
|
||
| Remove `docker.io/mcp/brave-search` container from workflows due to Critical and High CVEs with no upstream fix available (issue #48546). | ||
|
|
||
| The `shared/mcp/brave.md` MCP server definition has been emptied, its import removed from `brave.md` and `mcp-inspector.md`, and the pinned digest removed from `actions-lock.json`. Re-enable by restoring the `mcp-servers` block in `shared/mcp/brave.md` once a patched image is published upstream. |
Contributor
|
🎉 This pull request is included in a new release. Release: |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
docker.io/mcp/brave-search(pinned tosha256:f58a5c22) has 15 CVEs (1 Critical, 14 High) and 28 license violations. No patched upstream image exists — Docker Hub shows only thelatesttag, still pointing to the same vulnerable digest.Changes
shared/mcp/brave.md— Removed themcp-serversblock; replaced with a security notice and re-enable instructions for when a patched image is published upstreambrave.md— Removedshared/mcp/brave.mdimport (Brave Web Search Agent loses search capability until restored)mcp-inspector.md— Removedshared/mcp/brave.mdimportactions-lock.json,pkg/workflow/data/action_pins.json,pkg/actionpins/data/action_pins.json— Removeddocker.io/mcp/brave-searchcontainer pinbrave.lock.yml,mcp-inspector.lock.yml— Recompiled.changeset/patch-remove-brave-search-vulnerable-image.md— Added patch changeset