[docker-ptf] Remove gnoic - #27055
Merged
Merged
Conversation
|
|
Collaborator
|
/azp run Azure.sonic-buildimage |
|
Azure Pipelines successfully started running 1 pipeline(s). |
hdwhdw
force-pushed
the
remove-gnoic-from-ptf
branch
from
April 29, 2026 03:21
3757f51 to
6336684
Compare
Contributor
There was a problem hiding this comment.
Pull request overview
Removes the unused gnoic tool from the docker-ptf image build to eliminate CVE exposure from its upstream dependency set.
Changes:
- Removed the
gnoicbuild/install block fromdockers/docker-ptf/Dockerfile.j2and updated the related Go-toolchain comment. - Dropped
karimra/gnoicfromfiles/build/versions-public/default/versions-git. - Removed the
gnoicentry fromThirdPartyLicenses.txtwhile retaining the shared Apache 2.0 license text used by other components.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
dockers/docker-ptf/Dockerfile.j2 |
Eliminates building/installing gnoic in the PTF image; keeps Go toolchain usage for grpcurl/gnmic. |
files/build/versions-public/default/versions-git |
Removes the pinned gnoic source entry to match the image contents. |
ThirdPartyLicenses.txt |
Removes the gnoic attribution line while preserving the Apache 2.0 license body still needed by other entries. |
Collaborator
|
/azp run Azure.sonic-buildimage |
gnoic is unused in PTF and its upstream (karimra/gnoic) has not cut a release containing the x/crypto v0.45.0 fixes for CVE-2025-58181 and CVE-2025-47914 -- the latest tag v0.2.1 still ships x/crypto v0.43.0 and the renovate security PR is unmerged. Rather than carry a private patched build, drop it entirely. grpcurl and gnmic remain built from source with golang.org/x/* pinned to @latest, which already covers the related CVEs flagged by S360. Signed-off-by: Dawei Huang <daweihuang@microsoft.com>
hdwhdw
force-pushed
the
remove-gnoic-from-ptf
branch
from
April 29, 2026 03:22
6336684 to
b364fa3
Compare
|
Azure Pipelines will not run the associated pipelines, because the pull request was updated after the run command was issued. Review the pull request again and issue a new run command. |
Collaborator
|
/azp run Azure.sonic-buildimage |
|
Azure Pipelines successfully started running 1 pipeline(s). |
qiluo-msft
approved these changes
Apr 29, 2026
hdwhdw
added a commit
to sonic-net/sonic-mgmt
that referenced
this pull request
Apr 30, 2026
## Description of PR Add a conditional-mark `skip` for `tests/gnmi/test_gnmic.py` while the `gnmic` binary is being removed from `docker-ptf`. This is a precondition for the companion `docker-ptf` change that drops `gnmic` from the image. `tests/gnmi/test_gnmic.py` is the only test in this repo that invokes `/usr/local/bin/gnmic` directly (via `PtfGnmic.capabilities()`); without this skip, that test would start failing on the next `docker-ptf` rebuild. ## Summary Fixes # (issue): #24328 ## Type of change - [x] Test case (verification of existing or new feature) ## Back port request - [ ] Request back port to applicable release branches (master only — no behavior change for release branches that don't run this test) ## Approach ### What is the motivation for this PR? Reduce `docker-ptf` supply-chain surface. `gnoic` was removed in [sonic-buildimage#27055](sonic-net/sonic-buildimage#27055); `gnmic` is the next candidate because it has only one consumer in sonic-mgmt and that consumer can be skipped without losing coverage of any production behavior — `gnmi_tls.gnoi.*` and `pygnmi` cover the actual gNMI/gNOI surfaces under test. ### How did you do it? Added an entry under the `gnmi/` section of `tests_mark_conditions.yaml` that skips the test while #24328 is open. When the issue closes, the skip lifts — by then we should have either deleted the test outright or restored `gnmic`. ### How did you verify/test it? - `yaml.safe_load` parses the file cleanly with the new entry present. - conditional_mark plugin uses `pytest_collection_modifyitems`; no test execution required to confirm marker application — the existing `unit_test/` suite under `tests/common/plugins/conditional_mark/` covers that mechanism. ## Any platform specific information? None. ## Supported testbed topology if it's a new test case? N/A — no test added. ## Documentation N/A. Signed-off-by: Dawei Huang <daweihuang@microsoft.com>
2 tasks
14 tasks
vivekverma-arista
pushed a commit
to vivekverma-arista/sonic-buildimage
that referenced
this pull request
Apr 30, 2026
Why I did it gnoic is unused inside the PTF container, and its upstream (karimra/gnoic) has not cut a release containing the golang.org/x/crypto v0.45.0 fixes for CVE-2025-58181 (GHSA-j5w8-q4qc-rx2x) and CVE-2025-47914 (GHSA-f6x5-jh6r-wrfv). The latest tag v0.2.1 still ships x/crypto v0.43.0, and the renovate security PR (karimra/gnoic#170) is unmerged. Carrying a private patched build of an unused tool just to satisfy S360 scans is not worth the maintenance cost. How I did it Removed the gnoic build block from dockers/docker-ptf/Dockerfile.j2. Updated the Go-toolchain install comment to no longer mention gnoic. Removed the gnoic entry from files/build/versions-public/default/versions-git. Removed the gnoic line from ThirdPartyLicenses.txt (the shared Apache 2.0 license body is preserved because entry Introduced Cavium target sonic-net#4 apt-clean still uses it). grpcurl and gnmic are unaffected — they continue to be built from source with go get golang.org/x/...@latest && go mod tidy, which already covers the related CVEs flagged by S360. How to verify it grep -r gnoic dockers/docker-ptf/ files/build/versions-public/ ThirdPartyLicenses.txt returns nothing. Build docker-ptf; the resulting image no longer contains /usr/local/bin/gnoic. Re-run the S360 / Qualys ContainerImageScan against the new digest; CVE-2025-58181 and CVE-2025-47914 against /usr/local/bin/gnoic should disappear. Which release branch to backport (if applicable) N/A — master only. Older release branches do not contain the gnoic build block.
selldinesh
pushed a commit
to selldinesh/sonic-mgmt
that referenced
this pull request
May 4, 2026
## Description of PR Add a conditional-mark `skip` for `tests/gnmi/test_gnmic.py` while the `gnmic` binary is being removed from `docker-ptf`. This is a precondition for the companion `docker-ptf` change that drops `gnmic` from the image. `tests/gnmi/test_gnmic.py` is the only test in this repo that invokes `/usr/local/bin/gnmic` directly (via `PtfGnmic.capabilities()`); without this skip, that test would start failing on the next `docker-ptf` rebuild. ## Summary Fixes # (issue): sonic-net#24328 ## Type of change - [x] Test case (verification of existing or new feature) ## Back port request - [ ] Request back port to applicable release branches (master only — no behavior change for release branches that don't run this test) ## Approach ### What is the motivation for this PR? Reduce `docker-ptf` supply-chain surface. `gnoic` was removed in [sonic-buildimage#27055](sonic-net/sonic-buildimage#27055); `gnmic` is the next candidate because it has only one consumer in sonic-mgmt and that consumer can be skipped without losing coverage of any production behavior — `gnmi_tls.gnoi.*` and `pygnmi` cover the actual gNMI/gNOI surfaces under test. ### How did you do it? Added an entry under the `gnmi/` section of `tests_mark_conditions.yaml` that skips the test while sonic-net#24328 is open. When the issue closes, the skip lifts — by then we should have either deleted the test outright or restored `gnmic`. ### How did you verify/test it? - `yaml.safe_load` parses the file cleanly with the new entry present. - conditional_mark plugin uses `pytest_collection_modifyitems`; no test execution required to confirm marker application — the existing `unit_test/` suite under `tests/common/plugins/conditional_mark/` covers that mechanism. ## Any platform specific information? None. ## Supported testbed topology if it's a new test case? N/A — no test added. ## Documentation N/A. Signed-off-by: Dawei Huang <daweihuang@microsoft.com> Signed-off-by: selldinesh <dinesh.sellappan@keysight.com>
mhchann
pushed a commit
to mhchann/sonic-buildimage
that referenced
this pull request
May 7, 2026
Why I did it gnoic is unused inside the PTF container, and its upstream (karimra/gnoic) has not cut a release containing the golang.org/x/crypto v0.45.0 fixes for CVE-2025-58181 (GHSA-j5w8-q4qc-rx2x) and CVE-2025-47914 (GHSA-f6x5-jh6r-wrfv). The latest tag v0.2.1 still ships x/crypto v0.43.0, and the renovate security PR (karimra/gnoic#170) is unmerged. Carrying a private patched build of an unused tool just to satisfy S360 scans is not worth the maintenance cost. How I did it Removed the gnoic build block from dockers/docker-ptf/Dockerfile.j2. Updated the Go-toolchain install comment to no longer mention gnoic. Removed the gnoic entry from files/build/versions-public/default/versions-git. Removed the gnoic line from ThirdPartyLicenses.txt (the shared Apache 2.0 license body is preserved because entry Introduced Cavium target sonic-net#4 apt-clean still uses it). grpcurl and gnmic are unaffected — they continue to be built from source with go get golang.org/x/...@latest && go mod tidy, which already covers the related CVEs flagged by S360. How to verify it grep -r gnoic dockers/docker-ptf/ files/build/versions-public/ ThirdPartyLicenses.txt returns nothing. Build docker-ptf; the resulting image no longer contains /usr/local/bin/gnoic. Re-run the S360 / Qualys ContainerImageScan against the new digest; CVE-2025-58181 and CVE-2025-47914 against /usr/local/bin/gnoic should disappear. Which release branch to backport (if applicable) N/A — master only. Older release branches do not contain the gnoic build block. Signed-off-by: mhchann <mhchann082@gmail.com>
rraghav-cisco
pushed a commit
to rraghav-cisco/sonic-mgmt
that referenced
this pull request
May 11, 2026
## Description of PR Add a conditional-mark `skip` for `tests/gnmi/test_gnmic.py` while the `gnmic` binary is being removed from `docker-ptf`. This is a precondition for the companion `docker-ptf` change that drops `gnmic` from the image. `tests/gnmi/test_gnmic.py` is the only test in this repo that invokes `/usr/local/bin/gnmic` directly (via `PtfGnmic.capabilities()`); without this skip, that test would start failing on the next `docker-ptf` rebuild. ## Summary Fixes # (issue): sonic-net#24328 ## Type of change - [x] Test case (verification of existing or new feature) ## Back port request - [ ] Request back port to applicable release branches (master only — no behavior change for release branches that don't run this test) ## Approach ### What is the motivation for this PR? Reduce `docker-ptf` supply-chain surface. `gnoic` was removed in [sonic-buildimage#27055](sonic-net/sonic-buildimage#27055); `gnmic` is the next candidate because it has only one consumer in sonic-mgmt and that consumer can be skipped without losing coverage of any production behavior — `gnmi_tls.gnoi.*` and `pygnmi` cover the actual gNMI/gNOI surfaces under test. ### How did you do it? Added an entry under the `gnmi/` section of `tests_mark_conditions.yaml` that skips the test while sonic-net#24328 is open. When the issue closes, the skip lifts — by then we should have either deleted the test outright or restored `gnmic`. ### How did you verify/test it? - `yaml.safe_load` parses the file cleanly with the new entry present. - conditional_mark plugin uses `pytest_collection_modifyitems`; no test execution required to confirm marker application — the existing `unit_test/` suite under `tests/common/plugins/conditional_mark/` covers that mechanism. ## Any platform specific information? None. ## Supported testbed topology if it's a new test case? N/A — no test added. ## Documentation N/A. Signed-off-by: Dawei Huang <daweihuang@microsoft.com> Signed-off-by: Raghavendran Ramanathan <rraghav@cisco.com>
selldinesh
pushed a commit
to selldinesh/sonic-mgmt
that referenced
this pull request
Jun 11, 2026
## Description of PR Add a conditional-mark `skip` for `tests/gnmi/test_gnmic.py` while the `gnmic` binary is being removed from `docker-ptf`. This is a precondition for the companion `docker-ptf` change that drops `gnmic` from the image. `tests/gnmi/test_gnmic.py` is the only test in this repo that invokes `/usr/local/bin/gnmic` directly (via `PtfGnmic.capabilities()`); without this skip, that test would start failing on the next `docker-ptf` rebuild. ## Summary Fixes # (issue): sonic-net#24328 ## Type of change - [x] Test case (verification of existing or new feature) ## Back port request - [ ] Request back port to applicable release branches (master only — no behavior change for release branches that don't run this test) ## Approach ### What is the motivation for this PR? Reduce `docker-ptf` supply-chain surface. `gnoic` was removed in [sonic-buildimage#27055](sonic-net/sonic-buildimage#27055); `gnmic` is the next candidate because it has only one consumer in sonic-mgmt and that consumer can be skipped without losing coverage of any production behavior — `gnmi_tls.gnoi.*` and `pygnmi` cover the actual gNMI/gNOI surfaces under test. ### How did you do it? Added an entry under the `gnmi/` section of `tests_mark_conditions.yaml` that skips the test while sonic-net#24328 is open. When the issue closes, the skip lifts — by then we should have either deleted the test outright or restored `gnmic`. ### How did you verify/test it? - `yaml.safe_load` parses the file cleanly with the new entry present. - conditional_mark plugin uses `pytest_collection_modifyitems`; no test execution required to confirm marker application — the existing `unit_test/` suite under `tests/common/plugins/conditional_mark/` covers that mechanism. ## Any platform specific information? None. ## Supported testbed topology if it's a new test case? N/A — no test added. ## Documentation N/A. Signed-off-by: Dawei Huang <daweihuang@microsoft.com> Signed-off-by: selldinesh <dinesh.sellappan@keysight.com>
roger530-ho
pushed a commit
to roger530-ho/sonic-buildimage
that referenced
this pull request
Jun 23, 2026
Why I did it gnoic is unused inside the PTF container, and its upstream (karimra/gnoic) has not cut a release containing the golang.org/x/crypto v0.45.0 fixes for CVE-2025-58181 (GHSA-j5w8-q4qc-rx2x) and CVE-2025-47914 (GHSA-f6x5-jh6r-wrfv). The latest tag v0.2.1 still ships x/crypto v0.43.0, and the renovate security PR (karimra/gnoic#170) is unmerged. Carrying a private patched build of an unused tool just to satisfy S360 scans is not worth the maintenance cost. How I did it Removed the gnoic build block from dockers/docker-ptf/Dockerfile.j2. Updated the Go-toolchain install comment to no longer mention gnoic. Removed the gnoic entry from files/build/versions-public/default/versions-git. Removed the gnoic line from ThirdPartyLicenses.txt (the shared Apache 2.0 license body is preserved because entry Introduced Cavium target sonic-net#4 apt-clean still uses it). grpcurl and gnmic are unaffected — they continue to be built from source with go get golang.org/x/...@latest && go mod tidy, which already covers the related CVEs flagged by S360. How to verify it grep -r gnoic dockers/docker-ptf/ files/build/versions-public/ ThirdPartyLicenses.txt returns nothing. Build docker-ptf; the resulting image no longer contains /usr/local/bin/gnoic. Re-run the S360 / Qualys ContainerImageScan against the new digest; CVE-2025-58181 and CVE-2025-47914 against /usr/local/bin/gnoic should disappear. Which release branch to backport (if applicable) N/A — master only. Older release branches do not contain the gnoic build block.
selldinesh
pushed a commit
to selldinesh/sonic-mgmt
that referenced
this pull request
Jun 25, 2026
## Description of PR Add a conditional-mark `skip` for `tests/gnmi/test_gnmic.py` while the `gnmic` binary is being removed from `docker-ptf`. This is a precondition for the companion `docker-ptf` change that drops `gnmic` from the image. `tests/gnmi/test_gnmic.py` is the only test in this repo that invokes `/usr/local/bin/gnmic` directly (via `PtfGnmic.capabilities()`); without this skip, that test would start failing on the next `docker-ptf` rebuild. ## Summary Fixes # (issue): sonic-net#24328 ## Type of change - [x] Test case (verification of existing or new feature) ## Back port request - [ ] Request back port to applicable release branches (master only — no behavior change for release branches that don't run this test) ## Approach ### What is the motivation for this PR? Reduce `docker-ptf` supply-chain surface. `gnoic` was removed in [sonic-buildimage#27055](sonic-net/sonic-buildimage#27055); `gnmic` is the next candidate because it has only one consumer in sonic-mgmt and that consumer can be skipped without losing coverage of any production behavior — `gnmi_tls.gnoi.*` and `pygnmi` cover the actual gNMI/gNOI surfaces under test. ### How did you do it? Added an entry under the `gnmi/` section of `tests_mark_conditions.yaml` that skips the test while sonic-net#24328 is open. When the issue closes, the skip lifts — by then we should have either deleted the test outright or restored `gnmic`. ### How did you verify/test it? - `yaml.safe_load` parses the file cleanly with the new entry present. - conditional_mark plugin uses `pytest_collection_modifyitems`; no test execution required to confirm marker application — the existing `unit_test/` suite under `tests/common/plugins/conditional_mark/` covers that mechanism. ## Any platform specific information? None. ## Supported testbed topology if it's a new test case? N/A — no test added. ## Documentation N/A. Signed-off-by: Dawei Huang <daweihuang@microsoft.com> Signed-off-by: selldinesh <dinesh.sellappan@keysight.com>
xdqi
pushed a commit
to canonical/sonic-buildimage
that referenced
this pull request
Jul 6, 2026
Why I did it gnoic is unused inside the PTF container, and its upstream (karimra/gnoic) has not cut a release containing the golang.org/x/crypto v0.45.0 fixes for CVE-2025-58181 (GHSA-j5w8-q4qc-rx2x) and CVE-2025-47914 (GHSA-f6x5-jh6r-wrfv). The latest tag v0.2.1 still ships x/crypto v0.43.0, and the renovate security PR (karimra/gnoic#170) is unmerged. Carrying a private patched build of an unused tool just to satisfy S360 scans is not worth the maintenance cost. How I did it Removed the gnoic build block from dockers/docker-ptf/Dockerfile.j2. Updated the Go-toolchain install comment to no longer mention gnoic. Removed the gnoic entry from files/build/versions-public/default/versions-git. Removed the gnoic line from ThirdPartyLicenses.txt (the shared Apache 2.0 license body is preserved because entry Introduced Cavium target #4 apt-clean still uses it). grpcurl and gnmic are unaffected — they continue to be built from source with go get golang.org/x/...@latest && go mod tidy, which already covers the related CVEs flagged by S360. How to verify it grep -r gnoic dockers/docker-ptf/ files/build/versions-public/ ThirdPartyLicenses.txt returns nothing. Build docker-ptf; the resulting image no longer contains /usr/local/bin/gnoic. Re-run the S360 / Qualys ContainerImageScan against the new digest; CVE-2025-58181 and CVE-2025-47914 against /usr/local/bin/gnoic should disappear. Which release branch to backport (if applicable) N/A — master only. Older release branches do not contain the gnoic build block.
ssithaia-ebay
pushed a commit
to ssithaia-ebay/sflow-yang-sonic-mgmt
that referenced
this pull request
Jul 21, 2026
## Description of PR Add a conditional-mark `skip` for `tests/gnmi/test_gnmic.py` while the `gnmic` binary is being removed from `docker-ptf`. This is a precondition for the companion `docker-ptf` change that drops `gnmic` from the image. `tests/gnmi/test_gnmic.py` is the only test in this repo that invokes `/usr/local/bin/gnmic` directly (via `PtfGnmic.capabilities()`); without this skip, that test would start failing on the next `docker-ptf` rebuild. ## Summary Fixes # (issue): sonic-net#24328 ## Type of change - [x] Test case (verification of existing or new feature) ## Back port request - [ ] Request back port to applicable release branches (master only — no behavior change for release branches that don't run this test) ## Approach ### What is the motivation for this PR? Reduce `docker-ptf` supply-chain surface. `gnoic` was removed in [sonic-buildimage#27055](sonic-net/sonic-buildimage#27055); `gnmic` is the next candidate because it has only one consumer in sonic-mgmt and that consumer can be skipped without losing coverage of any production behavior — `gnmi_tls.gnoi.*` and `pygnmi` cover the actual gNMI/gNOI surfaces under test. ### How did you do it? Added an entry under the `gnmi/` section of `tests_mark_conditions.yaml` that skips the test while sonic-net#24328 is open. When the issue closes, the skip lifts — by then we should have either deleted the test outright or restored `gnmic`. ### How did you verify/test it? - `yaml.safe_load` parses the file cleanly with the new entry present. - conditional_mark plugin uses `pytest_collection_modifyitems`; no test execution required to confirm marker application — the existing `unit_test/` suite under `tests/common/plugins/conditional_mark/` covers that mechanism. ## Any platform specific information? None. ## Supported testbed topology if it's a new test case? N/A — no test added. ## Documentation N/A. Signed-off-by: Dawei Huang <daweihuang@microsoft.com> Signed-off-by: ssithaia-ebay <ssithaian@ebay.com>
ytzur1
pushed a commit
to ytzur1/sonic-mgmt
that referenced
this pull request
Jul 22, 2026
## Description of PR Add a conditional-mark `skip` for `tests/gnmi/test_gnmic.py` while the `gnmic` binary is being removed from `docker-ptf`. This is a precondition for the companion `docker-ptf` change that drops `gnmic` from the image. `tests/gnmi/test_gnmic.py` is the only test in this repo that invokes `/usr/local/bin/gnmic` directly (via `PtfGnmic.capabilities()`); without this skip, that test would start failing on the next `docker-ptf` rebuild. ## Summary Fixes # (issue): sonic-net#24328 ## Type of change - [x] Test case (verification of existing or new feature) ## Back port request - [ ] Request back port to applicable release branches (master only — no behavior change for release branches that don't run this test) ## Approach ### What is the motivation for this PR? Reduce `docker-ptf` supply-chain surface. `gnoic` was removed in [sonic-buildimage#27055](sonic-net/sonic-buildimage#27055); `gnmic` is the next candidate because it has only one consumer in sonic-mgmt and that consumer can be skipped without losing coverage of any production behavior — `gnmi_tls.gnoi.*` and `pygnmi` cover the actual gNMI/gNOI surfaces under test. ### How did you do it? Added an entry under the `gnmi/` section of `tests_mark_conditions.yaml` that skips the test while sonic-net#24328 is open. When the issue closes, the skip lifts — by then we should have either deleted the test outright or restored `gnmic`. ### How did you verify/test it? - `yaml.safe_load` parses the file cleanly with the new entry present. - conditional_mark plugin uses `pytest_collection_modifyitems`; no test execution required to confirm marker application — the existing `unit_test/` suite under `tests/common/plugins/conditional_mark/` covers that mechanism. ## Any platform specific information? None. ## Supported testbed topology if it's a new test case? N/A — no test added. ## Documentation N/A. Signed-off-by: Dawei Huang <daweihuang@microsoft.com> Signed-off-by: Yael Tzur <ytzur@nvidia.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why I did it
gnoicis unused inside the PTF container, and its upstream (karimra/gnoic) has not cut a release containing thegolang.org/x/cryptov0.45.0 fixes for CVE-2025-58181 (GHSA-j5w8-q4qc-rx2x) and CVE-2025-47914 (GHSA-f6x5-jh6r-wrfv). The latest tag v0.2.1 still shipsx/crypto v0.43.0, and the renovate security PR (karimra/gnoic#170) is unmerged.Carrying a private patched build of an unused tool just to satisfy S360 scans is not worth the maintenance cost.
How I did it
gnoicbuild block fromdockers/docker-ptf/Dockerfile.j2.files/build/versions-public/default/versions-git.ThirdPartyLicenses.txt(the shared Apache 2.0 license body is preserved because entry Introduced Cavium target #4apt-cleanstill uses it).grpcurlandgnmicare unaffected — they continue to be built from source withgo get golang.org/x/...@latest && go mod tidy, which already covers the related CVEs flagged by S360.How to verify it
grep -r gnoic dockers/docker-ptf/ files/build/versions-public/ ThirdPartyLicenses.txtreturns nothing.docker-ptf; the resulting image no longer contains/usr/local/bin/gnoic./usr/local/bin/gnoicshould disappear.Which release branch to backport (if applicable)
N/A — master only. Older release branches do not contain the gnoic build block.