Security Issue: Docker image v4.19.1 has 2 CRITICAL and 6 HIGH vulnerabilities

Trivy scan of migrate/migrate:v4.19.1 reveals 2 CRITICAL and 6 HIGH vulnerabilities. The image is built with Go 1.25.4 which has multiple known CVEs. Alpine 3.19 base image is also EOL.

Go Version

The current image is built with Go 1.25.4. 8 of the 12 vulnerabilities are in the Go stdlib and would be resolved by upgrading to Go 1.25.8+ or Go 1.26.x. This is the single most impactful fix.

Trivy Scan Results (2026-04-01)

OS: Alpine 3.19.9 (EOL) — 6 vulnerabilities (3 MEDIUM, 3 LOW)

• BusyBox CVE-2024-58251 (MEDIUM), CVE-2025-46394 (LOW) — fixed in 1.36.1-r21

Go Binary — 12 vulnerabilities (2 CRITICAL, 6 HIGH, 3 MEDIUM, 1 LOW)

Severity	CVE	Library	Installed	Fixed
CRITICAL	CVE-2026-33186	google.golang.org/grpc	v1.74.2	1.79.3
CRITICAL	CVE-2025-68121	stdlib (Go 1.25.4)	v1.25.4	1.25.7
HIGH	CVE-2025-61726	stdlib	v1.25.4	1.25.6
HIGH	CVE-2025-61728	stdlib	v1.25.4	1.25.6
HIGH	CVE-2025-61729	stdlib	v1.25.4	1.25.5
HIGH	CVE-2026-25679	stdlib	v1.25.4	1.25.8
HIGH	CVE-2026-24051	go.opentelemetry.io/otel/sdk	v1.36.0	1.40.0
HIGH	CVE-2026-32286	github.com/jackc/pgproto3/v2	v2.3.3	no fix

Suggested Fix

1. Upgrade Go to 1.25.8+ or 1.26.x — resolves 8 of 12 vulnerabilities including 1 CRITICAL
2. Upgrade Alpine base image to 3.21+ (3.19 is EOL)
3. Bump google.golang.org/grpc to >= 1.79.3 (CRITICAL — authz bypass)
4. Bump go.opentelemetry.io/otel/sdk to >= 1.40.0 (HIGH — PATH hijacking)

Environment

• Image: migrate/migrate:v4.19.1
• Scanner: Trivy v0.69.3
• Scan date: 2026-04-01