From c3f81414434b6aabcb260849468065bdadd8fb1a Mon Sep 17 00:00:00 2001
From: Mark <74402146+TechnoFinch@users.noreply.github.com>
Date: Tue, 20 Oct 2026 11:17:54 -0700
Subject: [PATCH 1/5] SEC-3320: build with Go 1.26.10 (crypto/x509 emSign
 intermediate blocklist)

---
 .devcontainer/Dockerfile                      |  4 +--
 dependencies.sh                               |  2 +-
 mooncake-common/etcd/go.mod                   | 25 +++++++++----------
 mooncake-p2p-store/src/p2pstore/go.mod        | 25 +++++++++----------
 .../example/http-metadata-server/go.mod       | 12 ++++-----
 5 files changed, 33 insertions(+), 35 deletions(-)

diff --git a/.devcontainer/Dockerfile b/.devcontainer/Dockerfile
index 51cf93e108..b016b86644 100644
--- a/.devcontainer/Dockerfile
+++ b/.devcontainer/Dockerfile
@@ -26,8 +26,8 @@ RUN apt-get install -y libibverbs-dev \
     pkg-config \
     patchelf
 
-RUN wget https://go.dev/dl/go1.22.12.linux-amd64.tar.gz \
-    && tar -C /usr/local -xzf go1.22.12.linux-amd64.tar.gz
+RUN wget https://go.dev/dl/go1.26.10.linux-amd64.tar.gz \
+    && tar -C /usr/local -xzf go1.26.10.linux-amd64.tar.gz
 
 RUN git clone https://github.com/alibaba/yalantinglibs.git \
     && cd yalantinglibs \
diff --git a/dependencies.sh b/dependencies.sh
index ae49fd1f65..5ad52c71ab 100755
--- a/dependencies.sh
+++ b/dependencies.sh
@@ -23,7 +23,7 @@ NC="\033[0m" # No Color
 # Configuration
 REPO_ROOT=`pwd`
 GITHUB_PROXY=${GITHUB_PROXY:-"https://github.com"}
-GOVER=1.23.8
+GOVER=1.26.10
 YALANTINGLIBS_VERSION=0.5.7
 
 # Function to print section headers
diff --git a/mooncake-common/etcd/go.mod b/mooncake-common/etcd/go.mod
index d795f03837..5c462d095f 100644
--- a/mooncake-common/etcd/go.mod
+++ b/mooncake-common/etcd/go.mod
@@ -1,27 +1,26 @@
 module github.com/kvcache-ai/Mooncake/mooncake-common/etcd
 
-go 1.23.0
+go 1.25.0
 
-toolchain go1.23.7
+toolchain go1.26.10
 
-require go.etcd.io/etcd/client/v3 v3.5.21
+require go.etcd.io/etcd/client/v3 v3.5.33
 
 require (
 	github.com/coreos/go-semver v0.3.0 // indirect
 	github.com/coreos/go-systemd/v22 v22.3.2 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/golang/protobuf v1.5.4 // indirect
-	go.etcd.io/etcd/api/v3 v3.5.21 // indirect
-	go.etcd.io/etcd/client/pkg/v3 v3.5.21 // indirect
+	go.etcd.io/etcd/api/v3 v3.5.33 // indirect
+	go.etcd.io/etcd/client/pkg/v3 v3.5.33 // indirect
 	go.uber.org/atomic v1.7.0 // indirect
 	go.uber.org/multierr v1.6.0 // indirect
 	go.uber.org/zap v1.17.0 // indirect
-	golang.org/x/net v0.38.0 // indirect
-	golang.org/x/sys v0.31.0 // indirect
-	golang.org/x/text v0.23.0 // indirect
-	google.golang.org/genproto v0.0.0-20230822172742-b8732ec3820d // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20230822172742-b8732ec3820d // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20230822172742-b8732ec3820d // indirect
-	google.golang.org/grpc v1.59.0 // indirect
-	google.golang.org/protobuf v1.33.0 // indirect
+	golang.org/x/net v0.58.0 // indirect
+	golang.org/x/sys v0.47.0 // indirect
+	golang.org/x/text v0.41.0 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa // indirect
+	google.golang.org/grpc v1.83.2 // indirect
+	google.golang.org/protobuf v1.36.11 // indirect
 )
diff --git a/mooncake-p2p-store/src/p2pstore/go.mod b/mooncake-p2p-store/src/p2pstore/go.mod
index 8d29b5ab85..08c28d9af0 100644
--- a/mooncake-p2p-store/src/p2pstore/go.mod
+++ b/mooncake-p2p-store/src/p2pstore/go.mod
@@ -1,27 +1,26 @@
 module github.com/kvcache-ai/Mooncake/mooncake-p2p-store/src/p2pstore
 
-go 1.23.0
+go 1.25.0
 
-toolchain go1.24.1
+toolchain go1.26.10
 
-require go.etcd.io/etcd/client/v3 v3.5.15
+require go.etcd.io/etcd/client/v3 v3.5.33
 
 require (
 	github.com/coreos/go-semver v0.3.0 // indirect
 	github.com/coreos/go-systemd/v22 v22.3.2 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/golang/protobuf v1.5.4 // indirect
-	go.etcd.io/etcd/api/v3 v3.5.15 // indirect
-	go.etcd.io/etcd/client/pkg/v3 v3.5.15 // indirect
+	go.etcd.io/etcd/api/v3 v3.5.33 // indirect
+	go.etcd.io/etcd/client/pkg/v3 v3.5.33 // indirect
 	go.uber.org/atomic v1.7.0 // indirect
 	go.uber.org/multierr v1.6.0 // indirect
 	go.uber.org/zap v1.17.0 // indirect
-	golang.org/x/net v0.38.0 // indirect
-	golang.org/x/sys v0.31.0 // indirect
-	golang.org/x/text v0.23.0 // indirect
-	google.golang.org/genproto v0.0.0-20230822172742-b8732ec3820d // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20230822172742-b8732ec3820d // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20230822172742-b8732ec3820d // indirect
-	google.golang.org/grpc v1.59.0 // indirect
-	google.golang.org/protobuf v1.33.0 // indirect
+	golang.org/x/net v0.58.0 // indirect
+	golang.org/x/sys v0.47.0 // indirect
+	golang.org/x/text v0.41.0 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa // indirect
+	google.golang.org/grpc v1.83.2 // indirect
+	google.golang.org/protobuf v1.36.11 // indirect
 )
diff --git a/mooncake-transfer-engine/example/http-metadata-server/go.mod b/mooncake-transfer-engine/example/http-metadata-server/go.mod
index 84a942aa88..c732b84c6e 100644
--- a/mooncake-transfer-engine/example/http-metadata-server/go.mod
+++ b/mooncake-transfer-engine/example/http-metadata-server/go.mod
@@ -1,8 +1,8 @@
 module github.com/kvcache-ai/Mooncake/mooncake-transfer-engine/example/http-metadata-server
 
-go 1.23.0
+go 1.25.0
 
-toolchain go1.23.8
+toolchain go1.26.10
 
 require github.com/gin-gonic/gin v1.10.0
 
@@ -27,10 +27,10 @@ require (
 	github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
 	github.com/ugorji/go/codec v1.2.12 // indirect
 	golang.org/x/arch v0.8.0 // indirect
-	golang.org/x/crypto v0.36.0 // indirect
-	golang.org/x/net v0.38.0 // indirect
-	golang.org/x/sys v0.31.0 // indirect
-	golang.org/x/text v0.23.0 // indirect
+	golang.org/x/crypto v0.52.0 // indirect
+	golang.org/x/net v0.54.0 // indirect
+	golang.org/x/sys v0.45.0 // indirect
+	golang.org/x/text v0.37.0 // indirect
 	google.golang.org/protobuf v1.34.1 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )

From 7c38327a5869953842544609cb14c74abca710bb Mon Sep 17 00:00:00 2001
From: Mark <74402146+TechnoFinch@users.noreply.github.com>
Date: Tue, 20 Oct 2026 11:45:23 -0700
Subject: [PATCH 2/5] SEC-3320: bump golang.org/x/net to v0.61.0 and x/text in
 http-metadata-server example

---
 .../example/http-metadata-server/go.mod                | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/mooncake-transfer-engine/example/http-metadata-server/go.mod b/mooncake-transfer-engine/example/http-metadata-server/go.mod
index c732b84c6e..808969fbc4 100644
--- a/mooncake-transfer-engine/example/http-metadata-server/go.mod
+++ b/mooncake-transfer-engine/example/http-metadata-server/go.mod
@@ -1,6 +1,6 @@
 module github.com/kvcache-ai/Mooncake/mooncake-transfer-engine/example/http-metadata-server
 
-go 1.25.0
+go 1.26.0
 
 toolchain go1.26.10
 
@@ -27,10 +27,10 @@ require (
 	github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
 	github.com/ugorji/go/codec v1.2.12 // indirect
 	golang.org/x/arch v0.8.0 // indirect
-	golang.org/x/crypto v0.52.0 // indirect
-	golang.org/x/net v0.54.0 // indirect
-	golang.org/x/sys v0.45.0 // indirect
-	golang.org/x/text v0.37.0 // indirect
+	golang.org/x/crypto v0.58.0 // indirect
+	golang.org/x/net v0.61.0 // indirect
+	golang.org/x/sys v0.49.0 // indirect
+	golang.org/x/text v0.43.0 // indirect
 	google.golang.org/protobuf v1.34.1 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )

From 4587cfba144f9de144582877a1058df1ef467d16 Mon Sep 17 00:00:00 2001
From: Mark <74402146+TechnoFinch@users.noreply.github.com>
Date: Wed, 21 Oct 2026 22:01:20 -0700
Subject: [PATCH 3/5] Update container base images for CVE fixes

- monitoring: prom/prometheus v2.54.0 -> v3.15.1 (Go 1.27.3, Debian 13 base)
- monitoring: grafana/grafana-oss:11.0.0 (Alpine 3.19, EOL) -> grafana/grafana:13.2.4 (Alpine 3.24)
- docker: install ca-certificates in runtime stages so the updated package is pulled at build time
---
 docker/mooncake.Dockerfile    | 1 +
 docker/musa.Dockerfile        | 1 +
 monitoring/docker-compose.yml | 4 ++--
 monitoring/run.sh             | 4 ++--
 4 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/docker/mooncake.Dockerfile b/docker/mooncake.Dockerfile
index 33542086fb..226cfe1957 100644
--- a/docker/mooncake.Dockerfile
+++ b/docker/mooncake.Dockerfile
@@ -78,6 +78,7 @@ ENV DEBIAN_FRONTEND=noninteractive \
 # Install runtime dependencies required by Mooncake
 RUN apt-get update && \
     apt-get install -y --no-install-recommends \
+        ca-certificates \
         python3 \
         python3-pip \
         ibverbs-providers \
diff --git a/docker/musa.Dockerfile b/docker/musa.Dockerfile
index d47564a321..8a54faa0e5 100644
--- a/docker/musa.Dockerfile
+++ b/docker/musa.Dockerfile
@@ -68,6 +68,7 @@ ENV DEBIAN_FRONTEND=noninteractive \
 # Install runtime dependencies required by Mooncake
 RUN apt-get update && \
     apt-get install -y --no-install-recommends \
+        ca-certificates \
         python3 \
         python3-pip \
         ibverbs-providers \
diff --git a/monitoring/docker-compose.yml b/monitoring/docker-compose.yml
index d2b9590ad8..9728a2b2f8 100644
--- a/monitoring/docker-compose.yml
+++ b/monitoring/docker-compose.yml
@@ -2,7 +2,7 @@ version: '3.8'
 
 services:
   prometheus:
-    image: prom/prometheus:v2.54.0
+    image: prom/prometheus:v3.15.1
     container_name: prometheus
     restart: unless-stopped
     ports:
@@ -20,7 +20,7 @@ services:
       - monitoring
 
   grafana:
-    image: grafana/grafana-oss:11.0.0
+    image: grafana/grafana:13.2.4
     container_name: grafana
     restart: unless-stopped
     ports:
diff --git a/monitoring/run.sh b/monitoring/run.sh
index 39257e572d..1fca00e772 100755
--- a/monitoring/run.sh
+++ b/monitoring/run.sh
@@ -23,7 +23,7 @@ docker run -d \
   -p 9090:9090 \
   -v "$SCRIPT_DIR/prometheus/prometheus.yml:/etc/prometheus/prometheus.yml" \
   --add-host host.docker.internal:host-gateway \
-  prom/prometheus:v2.54.0 \
+  prom/prometheus:v3.15.1 \
   --config.file=/etc/prometheus/prometheus.yml \
   --storage.tsdb.retention.time=15d \
   --web.console.libraries=/usr/share/prometheus/console_libraries \
@@ -41,7 +41,7 @@ docker run -d \
   -v grafana-data:/var/lib/grafana \
   -v "$SCRIPT_DIR/grafana/provisioning:/etc/grafana/provisioning" \
   -v "$SCRIPT_DIR/grafana/dashboards:/etc/grafana/dashboards" \
-  grafana/grafana-oss:11.0.0
+  grafana/grafana:13.2.4
 
 echo "Monitoring stack started!"
 echo "Prometheus: http://localhost:9090"

From 73af81f6b38ac86e871b510a32e3e7022fbb1586 Mon Sep 17 00:00:00 2001
From: Mark <74402146+TechnoFinch@users.noreply.github.com>
Date: Thu, 22 Oct 2026 00:06:11 -0700
Subject: [PATCH 4/5] Upgrade ca-certificates in vendor base images for CVE
 fixes

---
 .github/workflows/ci.yml   |  2 ++
 docker/mooncake.Dockerfile | 16 ++++++++++++++++
 docker/musa.Dockerfile     | 16 ++++++++++++++++
 3 files changed, 34 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 3f68759e64..d9dd959422 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -209,6 +209,8 @@ jobs:
     - name: Configure project
       run: |
         apt update -y
+        apt-get install -y --only-upgrade ca-certificates
+        dpkg --compare-versions "$(dpkg-query -W -f='${Version}' ca-certificates)" ge 20260816
         bash -x dependencies.sh -y
         mkdir build
         cd build
diff --git a/docker/mooncake.Dockerfile b/docker/mooncake.Dockerfile
index 226cfe1957..f7f698d6ba 100644
--- a/docker/mooncake.Dockerfile
+++ b/docker/mooncake.Dockerfile
@@ -8,6 +8,14 @@ ARG UBUNTU_VERSION=22.04
 
 FROM nvidia/cuda:${CUDA_VERSION}-devel-ubuntu${UBUNTU_VERSION} AS builder
 
+# CVE fix: pull the patched ca-certificates from the Ubuntu security pocket
+# until the upstream base image is rebuilt; fail if it is still old.
+RUN apt-get update && \
+    DEBIAN_FRONTEND=noninteractive apt-get install -y --only-upgrade ca-certificates && \
+    rm -rf /var/lib/apt/lists/* && \
+    v="$(dpkg-query -W -f='${Version}' ca-certificates)" && \
+    dpkg --compare-versions "$v" ge 20260816 || { echo "ca-certificates $v is older than 20260816" >&2; exit 1; }
+
 ENV DEBIAN_FRONTEND=noninteractive \
     PYTHONUNBUFFERED=1
 
@@ -71,6 +79,14 @@ RUN OUTPUT_DIR=dist ./scripts/build_wheel.sh
 ###############################################################################
 FROM nvidia/cuda:${CUDA_VERSION}-runtime-ubuntu${UBUNTU_VERSION} AS runtime
 
+# CVE fix: pull the patched ca-certificates from the Ubuntu security pocket
+# until the upstream base image is rebuilt; fail if it is still old.
+RUN apt-get update && \
+    DEBIAN_FRONTEND=noninteractive apt-get install -y --only-upgrade ca-certificates && \
+    rm -rf /var/lib/apt/lists/* && \
+    v="$(dpkg-query -W -f='${Version}' ca-certificates)" && \
+    dpkg --compare-versions "$v" ge 20260816 || { echo "ca-certificates $v is older than 20260816" >&2; exit 1; }
+
 ENV DEBIAN_FRONTEND=noninteractive \
     PYTHONUNBUFFERED=1 \
     PIP_NO_CACHE_DIR=1
diff --git a/docker/musa.Dockerfile b/docker/musa.Dockerfile
index 8a54faa0e5..fb28aabcf5 100644
--- a/docker/musa.Dockerfile
+++ b/docker/musa.Dockerfile
@@ -8,6 +8,14 @@ ARG UBUNTU_VERSION=22.04
 
 FROM mthreads/musa:${MUSA_VERSION}-devel-ubuntu${UBUNTU_VERSION}-amd64 AS builder
 
+# CVE fix: pull the patched ca-certificates from the Ubuntu security pocket
+# until the upstream base image is rebuilt; fail if it is still old.
+RUN apt-get update && \
+    DEBIAN_FRONTEND=noninteractive apt-get install -y --only-upgrade ca-certificates && \
+    rm -rf /var/lib/apt/lists/* && \
+    v="$(dpkg-query -W -f='${Version}' ca-certificates)" && \
+    dpkg --compare-versions "$v" ge 20260816 || { echo "ca-certificates $v is older than 20260816" >&2; exit 1; }
+
 ENV DEBIAN_FRONTEND=noninteractive \
     PYTHONUNBUFFERED=1
 
@@ -61,6 +69,14 @@ RUN OUTPUT_DIR=dist ./scripts/build_wheel.sh
 ###############################################################################
 FROM mthreads/musa:${MUSA_VERSION}-devel-ubuntu${UBUNTU_VERSION}-amd64 AS runtime
 
+# CVE fix: pull the patched ca-certificates from the Ubuntu security pocket
+# until the upstream base image is rebuilt; fail if it is still old.
+RUN apt-get update && \
+    DEBIAN_FRONTEND=noninteractive apt-get install -y --only-upgrade ca-certificates && \
+    rm -rf /var/lib/apt/lists/* && \
+    v="$(dpkg-query -W -f='${Version}' ca-certificates)" && \
+    dpkg --compare-versions "$v" ge 20260816 || { echo "ca-certificates $v is older than 20260816" >&2; exit 1; }
+
 ENV DEBIAN_FRONTEND=noninteractive \
     PYTHONUNBUFFERED=1 \
     PIP_NO_CACHE_DIR=1

From 932ad1c02a337f2f4d1a14e623045bb8f2f9828e Mon Sep 17 00:00:00 2001
From: Mark <74402146+TechnoFinch@users.noreply.github.com>
Date: Thu, 22 Oct 2026 00:20:15 -0700
Subject: [PATCH 5/5] Upgrade ca-certificates in Grafana image for CVE fixes

---
 monitoring/docker-compose.yml | 3 ++-
 monitoring/grafana/Dockerfile | 9 +++++++++
 monitoring/run.sh             | 3 ++-
 3 files changed, 13 insertions(+), 2 deletions(-)
 create mode 100644 monitoring/grafana/Dockerfile

diff --git a/monitoring/docker-compose.yml b/monitoring/docker-compose.yml
index 9728a2b2f8..93c4f6b198 100644
--- a/monitoring/docker-compose.yml
+++ b/monitoring/docker-compose.yml
@@ -20,7 +20,8 @@ services:
       - monitoring
 
   grafana:
-    image: grafana/grafana:13.2.4
+    build: ./grafana
+    image: mooncake-grafana:13.2.4
     container_name: grafana
     restart: unless-stopped
     ports:
diff --git a/monitoring/grafana/Dockerfile b/monitoring/grafana/Dockerfile
new file mode 100644
index 0000000000..63a1e124e5
--- /dev/null
+++ b/monitoring/grafana/Dockerfile
@@ -0,0 +1,9 @@
+FROM grafana/grafana:13.2.4
+
+# CVE fix: pull the patched ca-certificates from the Alpine repo until the
+# upstream image is rebuilt; fail if it is still old.
+USER root
+RUN apk upgrade --no-cache ca-certificates && \
+    v="$(apk info -e -v ca-certificates | sed 's/^ca-certificates-//')" && \
+    [ "$(apk version -t "$v" 20261020-r0)" != "<" ] || { echo "ca-certificates $v is older than 20261020-r0" >&2; exit 1; }
+USER 472
diff --git a/monitoring/run.sh b/monitoring/run.sh
index 1fca00e772..de59f723cb 100755
--- a/monitoring/run.sh
+++ b/monitoring/run.sh
@@ -30,6 +30,7 @@ docker run -d \
   --web.console.templates=/usr/share/prometheus/consoles
 
 echo "Starting Grafana..."
+docker build -t mooncake-grafana:13.2.4 "$SCRIPT_DIR/grafana" || exit 1
 docker run -d \
   --name grafana \
   --restart unless-stopped \
@@ -41,7 +42,7 @@ docker run -d \
   -v grafana-data:/var/lib/grafana \
   -v "$SCRIPT_DIR/grafana/provisioning:/etc/grafana/provisioning" \
   -v "$SCRIPT_DIR/grafana/dashboards:/etc/grafana/dashboards" \
-  grafana/grafana:13.2.4
+  mooncake-grafana:13.2.4
 
 echo "Monitoring stack started!"
 echo "Prometheus: http://localhost:9090"