[maciaszczykm]

Keep cloud-query-db on Docker Hardened Images (dhi.io/postgres, Debian) instead of switching to Minimus, which shut down and took its registry offline. Bump PostgreSQL and rebuild the Steampipe extensions with a newer Go toolchain to resolve their Go stdlib vulnerabilities.

• Bump PostgreSQL to the latest DHI patch release. DHI's catalog reports no critical, high or medium findings for it. The earlier 297 findings came from a scan that ignored DHI's VEX data.
• Drop the apt-get step and the gcloud CLI download/copy; the copied wrapper didn't work (no python in the runtime image).
• Bump Steampipe extensions to fork releases rebuilt with the newer Go toolchain (pluralsh/steampipe-workflows#1). This removes the Go stdlib CVEs from each extension.

DHI's Alpine variant is not an option: Go-built Steampipe FDWs segfault on musl at CREATE EXTENSION.

• vSphere
• GCP
• Azure
• AWS

Future bumps like this one are handed to the Vulnerability Remediation workbench in plrl-dev-aws. It now has the six pluralsh/steampipe-* forks in scope, plus a steampipe-fork-maintenance skill covering the whole chain:

• which fork owns a given CVE;
• fixing it there and releasing the fork by tag push;
• checking the release assets;
• then bumping the extension versions here.

Fork PRs and tags stay in the pluralsh repositories, and release tags are never pushed by the agent; it hands the commands to a human.

See: https://github.com/pluralsh/plrl-dev-aws/commit/be370dd638544dcf24b92322801866dc32d17b76

Test Plan

Test image: ghcr.io/pluralsh/cloud-query-db:pr-4492

Checklist

• I have added a meaningful title and summary to convey the impact of this PR to a user.
• If required, I have updated the Plural documentation accordingly.
• I have added tests to cover my changes.
• I have deployed the agent to a test environment and verified that it works as expected (required only when changing agent code).

Plural Flow: console

[soffi-ai]

Soffi AI Summary

This PR maintains the cloud-query-db Docker image on Docker Hardened Images (DHI) PostgreSQL instead of switching to Minimus (which shut down), bumps PostgreSQL to 15.19, and rebuilds all four Steampipe FDW extensions (AWS, Azure, GCP, vSphere) against a newer Go toolchain (Go 1.27.3) to eliminate Go stdlib CVEs. The gcloud CLI download and apt-get installation steps are also removed from the Dockerfile build since the copied gcloud wrapper was non-functional in the runtime image (no Python available). The Steampipe extension version bumps come from upstream fork releases in pluralsh/steampipe-workflows, and a Vulnerability Remediation workbench workflow has been established for handling future bumps of this kind.

Changes

cloud-query-db image security hardening

• Initial attempt to switch the base image to Minimus PostgreSQL 15.19 to address CVEs (later superseded in favor of staying on DHI). (32e29cc)
• Reverted the Minimus switch; bumped DHI PostgreSQL to 15.19 and removed the broken gcloud CLI download/copy step (gcloud requires Python, which is not present in the runtime image). (7a99f59)
• Merge from master to keep the branch up to date. (04ff7bc)
• Bumped the vSphere Steampipe extension to 0.1.4, rebuilt against the newer Go toolchain to remove Go stdlib CVEs. (609780a)
• Bumped AWS (1.30.9), Azure (1.12.5), and GCP (1.13.6) Steampipe extensions to fork releases rebuilt with Go 1.27.3, eliminating remaining Go stdlib CVEs from each extension. (bce6dc9)
• Merge from master to keep the branch up to date. (714154e)

---

Updated: 2026-10-26 09:32 UTC

Deploy in Soffi

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; no blocking issue was found.

Summary

Updates cloud-query-db to DHI PostgreSQL 15.19 and newer AWS, Azure, GCP, and vSphere extension releases.

• The cloud-query database image moves to PostgreSQL 15.19 and newer provider extensions.
• The cloud-query database image no longer includes the gcloud CLI.

_{Reviews (2) · Last reviewed commit: "Merge remote-tracking branch 'origin/mas..." · Reviewed by Greptile}

[michaeljguarino]

We should add the update skills to the main plrldemo environment so we can easily execute them in releases

[maciaszczykm]

@michaeljguarino It's added to plrldemo now.