harbor-2.12/2.12.0-r2: cve remediation

[octo-sts]

harbor-2.12/2.12.0-r2: fix GHSA-9j3m-fr7q-jxfw

Advisory data: https://github.com/wolfi-dev/advisories/blob/main/harbor-2.12.advisories.yaml

[octo-sts]

Gen AI suggestions to solve the build error:

• Detected Error: "cannot use rs (variable of type *Store) as "github.com/beego/beego/v2/server/web/session".Store value in return statement: *Store does not implement "github.com/beego/beego/v2/server/web/session".Store (missing method SessionReleaseIfPresent)"

• Error Category: Build

• Failure Point: Go compilation of core/session/session.go during go/build step

• Root Cause Analysis: The Store type in Harbor's session implementation is missing a required method (SessionReleaseIfPresent) from the beego/beego/v2 session.Store interface after upgrading beego to v2.3.4.

• Suggested Fix:

1. Add the missing method to the Store type in core/session/session.go:

func (s *Store) SessionReleaseIfPresent(w http.ResponseWriter) {}

• Explanation:
The beego framework v2.3.4 introduced a new required method in its session.Store interface. By implementing this method (even as an empty implementation if not needed), the Store type will satisfy the interface requirements and allow compilation to succeed.

• Additional Notes:

• This is a common issue when upgrading dependencies that introduce new interface requirements
• The empty implementation is safe if the method isn't actually needed for Harbor's session handling
• Alternative approach could be to pin to an earlier beego version, but implementing the interface is more forward-compatible

• References:

• https://github.com/beego/beego/blob/v2.3.4/server/web/session/session.go
• https://github.com/goharbor/harbor/issues (similar upgrade issues)
• https://github.com/beego/beego/releases/tag/v2.3.4 (interface changes)

[Dentrax]

Submitted adv here: wolfi-dev/advisories#10068