Flight Log / microsoft/azurelinux #13859

Patch docker-buildx for CVE-2025-22872 — a GitHub Copilot (GitHub) bot flight

The GitHub Copilot bot (GitHub) opened this pull request in microsoft/azurelinux on May 22, 2025; a burn — closed unmerged after human review: +108 −49, 3 files, 0 reviews.

All agent flights in microsoft/azurelinux · GitHub Copilot flights

BurnGitHub Copilot flights by GitHub ↗ attribution: AIDev dataset

Flown by @CopilotGitHub ↗— unclaimed

Lines: +108 −49
Files: 3
Commits: 5
Reviews: 0
To merge: —
Task: fix

Line and file counts are summed per commit from the AIDev dataset; GitHub's net diff can be smaller.

GitHub Copilot opened a fix PR in microsoft/azurelinux to patch docker-buildx for CVE-2025-22872, applying an upstream Go net package patch for trailing solidus handling. The change touched three files across five commits, adding 108 lines and removing 49. The PR closed unmerged after human review, which asked that patch paths reference vendor/golang.org/x/net/html/token.go.

“update patch file paths in SPECS/docker-buildx/CVE-2025-22872.patch from html/token.go to vendor/golang.org/x/net/html/token.go”
— from the review (source)

From the pull request description

## Summary This PR addresses CVE-2025-22872 in the docker-buildx package by applying the upstream patch from the Go library. ## Changes - Added upstream patch from Golang's net package that fixes improper handling of trailing solidus in unquoted attribute values in foreign content - Incremented the…

Excerpt (first 300 characters) — the full description is on GitHub.

View the pull request on GitHub →

This is your flight? Claim it — sign in with GitHub. Ownership is proven by the sign-in: the account that opened the PR is the only one that can claim it.

Flight timeline

—committedcopilot-swe-agent[bot]
—committedcopilot-swe-agent[bot]
—committedcopilot-swe-agent[bot]
—committedcopilot-swe-agent[bot]
—committedcopilot-swe-agent[bot]
May 22, 2025labeledmicrosoft-github-policy-service[bot]
May 22, 2025labeledmicrosoft-github-policy-service[bot]
May 22, 2025labeledmicrosoft-github-policy-service[bot]
Jul 23, 2025closedKanishk-Bansal

Patch docker-buildx for CVE-2025-22872 — a GitHub Copilot (GitHub) bot flight

From the pull request description

Flight timeline

More agent flights in microsoft/azurelinux

More agent flights by Copilot

Other fix flights by GitHub Copilot

Read next