From f62879ef4b34e2d068c45c0c2c6e1dee8ed1f041 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sun, 2 Aug 2026 11:41:19 +0000
Subject: [PATCH 1/2] Initial plan


From 7a15c77d945ecdcd1c284b13f31a8e9ab1d64267 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sun, 2 Aug 2026 11:56:28 +0000
Subject: [PATCH 2/2] fix(security): remove vulnerable gh-aw-firewall 0.27.42
 container pins (agent, api-proxy, squid)

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
---
 .../patch-remove-vulnerable-awf-0-27-42-pins.md   |  5 +++++
 .github/aw/actions-lock.json                      | 15 ---------------
 pkg/actionpins/data/action_pins.json              | 15 ---------------
 pkg/workflow/data/action_pins.json                | 15 ---------------
 4 files changed, 5 insertions(+), 45 deletions(-)
 create mode 100644 .changeset/patch-remove-vulnerable-awf-0-27-42-pins.md

diff --git a/.changeset/patch-remove-vulnerable-awf-0-27-42-pins.md b/.changeset/patch-remove-vulnerable-awf-0-27-42-pins.md
new file mode 100644
index 00000000000..232be182990
--- /dev/null
+++ b/.changeset/patch-remove-vulnerable-awf-0-27-42-pins.md
@@ -0,0 +1,5 @@
+---
+"gh-aw": patch
+---
+
+Remove vulnerable `ghcr.io/github/gh-aw-firewall` `0.27.42` container image pins (agent, api-proxy, squid) from the shared action lock data. These images contained High-severity CVEs (grpc GHSA-hrxh-6v49-42gf, brace-expansion GHSA-mh99-v99m-4gvg, golang.org/x/text GO-2026-5970). The default firewall version is already `v0.27.43` which addresses these findings; removing the `0.27.42` pins ensures these vulnerable digests are no longer resolvable from lock metadata.
diff --git a/.github/aw/actions-lock.json b/.github/aw/actions-lock.json
index d225c03bb18..422cda25f86 100644
--- a/.github/aw/actions-lock.json
+++ b/.github/aw/actions-lock.json
@@ -165,21 +165,11 @@
     }
   },
   "containers": {
-    "ghcr.io/github/gh-aw-firewall/agent:0.27.42": {
-      "image": "ghcr.io/github/gh-aw-firewall/agent:0.27.42",
-      "digest": "sha256:26a8af4e5566485b02f52af59ee03803ae798271a9619d4767e94d07806deb9b",
-      "pinned_image": "ghcr.io/github/gh-aw-firewall/agent:0.27.42@sha256:26a8af4e5566485b02f52af59ee03803ae798271a9619d4767e94d07806deb9b"
-    },
     "ghcr.io/github/gh-aw-firewall/agent:0.27.43": {
       "image": "ghcr.io/github/gh-aw-firewall/agent:0.27.43",
       "digest": "sha256:04e2d1987a565000a8f114b89d806ae7a3864dd4f944be65275b28c93d8690e6",
       "pinned_image": "ghcr.io/github/gh-aw-firewall/agent:0.27.43@sha256:04e2d1987a565000a8f114b89d806ae7a3864dd4f944be65275b28c93d8690e6"
     },
-    "ghcr.io/github/gh-aw-firewall/api-proxy:0.27.42": {
-      "image": "ghcr.io/github/gh-aw-firewall/api-proxy:0.27.42",
-      "digest": "sha256:944f2686c9ab9bec338fd14b662461662f77cd12cd0ea8a3e7cb8c0987cd1607",
-      "pinned_image": "ghcr.io/github/gh-aw-firewall/api-proxy:0.27.42@sha256:944f2686c9ab9bec338fd14b662461662f77cd12cd0ea8a3e7cb8c0987cd1607"
-    },
     "ghcr.io/github/gh-aw-firewall/api-proxy:0.27.43": {
       "image": "ghcr.io/github/gh-aw-firewall/api-proxy:0.27.43",
       "digest": "sha256:d85f57975af5ea23af4996e41ed73fbc8f5b4a47402472bfe82e508f352cb0c1",
@@ -190,11 +180,6 @@
       "digest": "sha256:65c45ea2967984d0024f3df61bc71335658a77ede96c8d9665da7a5f33a795ab",
       "pinned_image": "ghcr.io/github/gh-aw-firewall/cli-proxy:0.27.43@sha256:65c45ea2967984d0024f3df61bc71335658a77ede96c8d9665da7a5f33a795ab"
     },
-    "ghcr.io/github/gh-aw-firewall/squid:0.27.42": {
-      "image": "ghcr.io/github/gh-aw-firewall/squid:0.27.42",
-      "digest": "sha256:42dfeb649c680a8558cd5423dbc530b653a69413e35ffbe5e71da5d48c94bdf0",
-      "pinned_image": "ghcr.io/github/gh-aw-firewall/squid:0.27.42@sha256:42dfeb649c680a8558cd5423dbc530b653a69413e35ffbe5e71da5d48c94bdf0"
-    },
     "ghcr.io/github/gh-aw-firewall/squid:0.27.43": {
       "image": "ghcr.io/github/gh-aw-firewall/squid:0.27.43",
       "digest": "sha256:26be5e0b8c8f4c41c8a59126b29bb5d80b07253597472ded2a16bdd75abcbf9d",
diff --git a/pkg/actionpins/data/action_pins.json b/pkg/actionpins/data/action_pins.json
index d225c03bb18..422cda25f86 100644
--- a/pkg/actionpins/data/action_pins.json
+++ b/pkg/actionpins/data/action_pins.json
@@ -165,21 +165,11 @@
     }
   },
   "containers": {
-    "ghcr.io/github/gh-aw-firewall/agent:0.27.42": {
-      "image": "ghcr.io/github/gh-aw-firewall/agent:0.27.42",
-      "digest": "sha256:26a8af4e5566485b02f52af59ee03803ae798271a9619d4767e94d07806deb9b",
-      "pinned_image": "ghcr.io/github/gh-aw-firewall/agent:0.27.42@sha256:26a8af4e5566485b02f52af59ee03803ae798271a9619d4767e94d07806deb9b"
-    },
     "ghcr.io/github/gh-aw-firewall/agent:0.27.43": {
       "image": "ghcr.io/github/gh-aw-firewall/agent:0.27.43",
       "digest": "sha256:04e2d1987a565000a8f114b89d806ae7a3864dd4f944be65275b28c93d8690e6",
       "pinned_image": "ghcr.io/github/gh-aw-firewall/agent:0.27.43@sha256:04e2d1987a565000a8f114b89d806ae7a3864dd4f944be65275b28c93d8690e6"
     },
-    "ghcr.io/github/gh-aw-firewall/api-proxy:0.27.42": {
-      "image": "ghcr.io/github/gh-aw-firewall/api-proxy:0.27.42",
-      "digest": "sha256:944f2686c9ab9bec338fd14b662461662f77cd12cd0ea8a3e7cb8c0987cd1607",
-      "pinned_image": "ghcr.io/github/gh-aw-firewall/api-proxy:0.27.42@sha256:944f2686c9ab9bec338fd14b662461662f77cd12cd0ea8a3e7cb8c0987cd1607"
-    },
     "ghcr.io/github/gh-aw-firewall/api-proxy:0.27.43": {
       "image": "ghcr.io/github/gh-aw-firewall/api-proxy:0.27.43",
       "digest": "sha256:d85f57975af5ea23af4996e41ed73fbc8f5b4a47402472bfe82e508f352cb0c1",
@@ -190,11 +180,6 @@
       "digest": "sha256:65c45ea2967984d0024f3df61bc71335658a77ede96c8d9665da7a5f33a795ab",
       "pinned_image": "ghcr.io/github/gh-aw-firewall/cli-proxy:0.27.43@sha256:65c45ea2967984d0024f3df61bc71335658a77ede96c8d9665da7a5f33a795ab"
     },
-    "ghcr.io/github/gh-aw-firewall/squid:0.27.42": {
-      "image": "ghcr.io/github/gh-aw-firewall/squid:0.27.42",
-      "digest": "sha256:42dfeb649c680a8558cd5423dbc530b653a69413e35ffbe5e71da5d48c94bdf0",
-      "pinned_image": "ghcr.io/github/gh-aw-firewall/squid:0.27.42@sha256:42dfeb649c680a8558cd5423dbc530b653a69413e35ffbe5e71da5d48c94bdf0"
-    },
     "ghcr.io/github/gh-aw-firewall/squid:0.27.43": {
       "image": "ghcr.io/github/gh-aw-firewall/squid:0.27.43",
       "digest": "sha256:26be5e0b8c8f4c41c8a59126b29bb5d80b07253597472ded2a16bdd75abcbf9d",
diff --git a/pkg/workflow/data/action_pins.json b/pkg/workflow/data/action_pins.json
index d225c03bb18..422cda25f86 100644
--- a/pkg/workflow/data/action_pins.json
+++ b/pkg/workflow/data/action_pins.json
@@ -165,21 +165,11 @@
     }
   },
   "containers": {
-    "ghcr.io/github/gh-aw-firewall/agent:0.27.42": {
-      "image": "ghcr.io/github/gh-aw-firewall/agent:0.27.42",
-      "digest": "sha256:26a8af4e5566485b02f52af59ee03803ae798271a9619d4767e94d07806deb9b",
-      "pinned_image": "ghcr.io/github/gh-aw-firewall/agent:0.27.42@sha256:26a8af4e5566485b02f52af59ee03803ae798271a9619d4767e94d07806deb9b"
-    },
     "ghcr.io/github/gh-aw-firewall/agent:0.27.43": {
       "image": "ghcr.io/github/gh-aw-firewall/agent:0.27.43",
       "digest": "sha256:04e2d1987a565000a8f114b89d806ae7a3864dd4f944be65275b28c93d8690e6",
       "pinned_image": "ghcr.io/github/gh-aw-firewall/agent:0.27.43@sha256:04e2d1987a565000a8f114b89d806ae7a3864dd4f944be65275b28c93d8690e6"
     },
-    "ghcr.io/github/gh-aw-firewall/api-proxy:0.27.42": {
-      "image": "ghcr.io/github/gh-aw-firewall/api-proxy:0.27.42",
-      "digest": "sha256:944f2686c9ab9bec338fd14b662461662f77cd12cd0ea8a3e7cb8c0987cd1607",
-      "pinned_image": "ghcr.io/github/gh-aw-firewall/api-proxy:0.27.42@sha256:944f2686c9ab9bec338fd14b662461662f77cd12cd0ea8a3e7cb8c0987cd1607"
-    },
     "ghcr.io/github/gh-aw-firewall/api-proxy:0.27.43": {
       "image": "ghcr.io/github/gh-aw-firewall/api-proxy:0.27.43",
       "digest": "sha256:d85f57975af5ea23af4996e41ed73fbc8f5b4a47402472bfe82e508f352cb0c1",
@@ -190,11 +180,6 @@
       "digest": "sha256:65c45ea2967984d0024f3df61bc71335658a77ede96c8d9665da7a5f33a795ab",
       "pinned_image": "ghcr.io/github/gh-aw-firewall/cli-proxy:0.27.43@sha256:65c45ea2967984d0024f3df61bc71335658a77ede96c8d9665da7a5f33a795ab"
     },
-    "ghcr.io/github/gh-aw-firewall/squid:0.27.42": {
-      "image": "ghcr.io/github/gh-aw-firewall/squid:0.27.42",
-      "digest": "sha256:42dfeb649c680a8558cd5423dbc530b653a69413e35ffbe5e71da5d48c94bdf0",
-      "pinned_image": "ghcr.io/github/gh-aw-firewall/squid:0.27.42@sha256:42dfeb649c680a8558cd5423dbc530b653a69413e35ffbe5e71da5d48c94bdf0"
-    },
     "ghcr.io/github/gh-aw-firewall/squid:0.27.43": {
       "image": "ghcr.io/github/gh-aw-firewall/squid:0.27.43",
       "digest": "sha256:26be5e0b8c8f4c41c8a59126b29bb5d80b07253597472ded2a16bdd75abcbf9d",