openreplay 1.1.1 Helm chart

Name: openreplay Helm chart 1.1.1: images and vulnerabilities
Creator: StackRadar
License: https://creativecommons.org/licenses/by/4.0/

helmforge

Scored 20 Oct 2026

Production-ready OpenReplay session replay stack without a bundled ingress controller

Version 1.1.1 todayapp version 1.28.0 0Artifact Hub

openreplay 1.1.1 deploys 24 container images: ghcr.io/openreplay/postgres, public.ecr.aws/p1t3u8a3/alerts, public.ecr.aws/p1t3u8a3/api, public.ecr.aws/p1t3u8a3/assets and 19 more. Across them, 1,348 findings — 2 critical, 5 high. The highest contribution is ALPINE-CVE-2025-15467 in openssl 3.5.4-r0, fixed in 3.5.5-r0. Chart.yaml declares kubeVersion >=1.31.0-0; rendered for Kubernetes 1.31.0.

Radar Score

15,638252501,091

1,348 findings over 24 of 24 images measured

Radar Score is the sum of every finding’s contribution; the colour is the worst finding’s band.

Container images

24 images

Image	Tag	Vulnerabilities	Radar Score
ghcr.io/openreplay/postgres×16	17	00010	109
public.ecr.aws/p1t3u8a3/alerts	v1.28.0	00020	135
public.ecr.aws/p1t3u8a3/api	v1.28.5	00321	272
public.ecr.aws/p1t3u8a3/assets	v1.28.0	00216	198
public.ecr.aws/p1t3u8a3/assist	v1.28.0	001048	709
public.ecr.aws/p1t3u8a3/canvases	v1.28.0	00320	265
public.ecr.aws/p1t3u8a3/chalice	v1.28.6	00013	65
public.ecr.aws/p1t3u8a3/db	v1.28.0	00214	186
public.ecr.aws/p1t3u8a3/ender	v1.28.0	00214	186
public.ecr.aws/p1t3u8a3/frontend	v1.28.3	0005	29
public.ecr.aws/p1t3u8a3/http	v1.28.0	00318	253
public.ecr.aws/p1t3u8a3/images	v1.28.0	00320	265
public.ecr.aws/p1t3u8a3/sink	v1.28.0	00214	186
public.ecr.aws/p1t3u8a3/sourcemapreader	v1.28.1	00022	226
public.ecr.aws/p1t3u8a3/spot	v1.28.0	00432	368
public.ecr.aws/p1t3u8a3/storage	v1.28.0	00216	198
library/caddy	2.10.2-alpine	0145154	2,424
rustfs/rustfs	1.0.0	0002	21
clickhouse/clickhouse-server	26.9.16	1235120	1,911
library/postgres	18.6-trixie	0020155	1,815
library/redis	8.10.2	00663	640
alpine/git	2.52.0	0234112	1,911
ghcr.io/openreplay/minio	2025	0056152	2,564
clickhouse/clickhouse-server	25.9-alpine	101830	702

Rendered with the chart’s default values for linux/amd64. Optional subcharts, images set by operator flags and images inside CRD payloads are not seen and are counted as unmeasured.

Low findings

555 distinct across the version’s images

Low: findings whose contribution to the Radar Score is 1–14. Show every band

Severity	Advisory	Package	Fixed in
Low	GHSA-gvwx-54wh-qm9j	tar@7.5.11	7.5.17
Low	DEBIAN-CVE-2026-86143	libxml2@2.12.7+dfsg+really2.9.14-2.1+deb13u3	no fix listed
Low	GHSA-h3mg-xc3c-68pw	ip-address@10.2.0	10.7.1
Low	CGA-hp9g-hv8v-9qxc	minio@0.20251015.172955-r10	0.20260520.234452-r2
Low	GHSA-78mq-xcr3-xm33	golang.org/x/crypto@v0.51.0	0.52.0
Low	UBUNTU-CVE-2026-88837	busybox@1:1.30.1-7ubuntu3.1	no fix listed
Low	DEBIAN-CVE-2026-86140	libxml2@2.12.7+dfsg+really2.9.14-2.1+deb13u3	no fix listed
Low	DEBIAN-CVE-2026-86142	libxml2@2.12.7+dfsg+really2.9.14-2.1+deb13u3	no fix listed
Low	CGA-7m45-h3jr-jcc5	minio@0.20251015.172955-r10	0.20260504.002721-r0
Low	GHSA-3rh2-v3gr-35p9	github.com/minio/minio@v0.0.0-20251015172955-9e49d5e7a648+dirty	no fix listed
Low	UBUNTU-CVE-2026-78410	util-linux@2.37.2-4ubuntu3.6	no fix listed
Low	ALPINE-CVE-2026-34181	openssl@3.5.6-r0	3.5.7-r0
Low	ALPINE-CVE-2026-4873	curl@8.19.0-r0	8.20.0-r0
Low	ALPINE-CVE-2026-89160	pcre2@10.47-r0	10.48-r0
Low	DEBIAN-CVE-2026-77117	glibc@2.41-12+deb13u4	no fix listed
Low	DEBIAN-CVE-2026-80489	glibc@2.41-12+deb13u4	no fix listed
Low	GHSA-vvgj-x9jq-8cj9	github.com/quic-go/quic-go@v0.54.0	0.59.1
Low	GHSA-cp6g-7hqx-qxhp	go.mongodb.org/mongo-driver@v1.17.3	1.17.7
Low	DEBIAN-CVE-2022-0563	util-linux@2.41.5-0+deb13u1	no fix listed
Low	ALPINE-CVE-2026-102633	expat@2.8.5-r0	2.9.0-r0
Low	GHSA-hj66-6f7g-4r5v	oauthlib@3.3.1	4.0.0
Low	CGA-29g6-2923-rp6f	minio@0.20251015.172955-r10	0.20260717.120751-r6
Low	GO-2026-6091	stdlib@go1.25.10	1.25.13
Low	DEBIAN-CVE-2026-11979	libxml2@2.12.7+dfsg+really2.9.14-2.1+deb13u3	no fix listed
Low	ALPINE-CVE-2026-7168	curl@8.19.0-r0	8.20.0-r0
Low	GO-2025-4008	stdlib@go1.25.0	1.24.8
Low	GO-2025-4010	stdlib@go1.25.0	1.24.8
Low	UBUNTU-CVE-2023-42366	busybox@1:1.30.1-7ubuntu3.1	no fix listed
Low	CGA-36vp-h3pj-4jgr	minio@0.20251015.172955-r10	0.20260717.120751-r1
Low	GHSA-hrxh-6v49-42gf	google.golang.org/grpc@v1.79.3	1.82.1
Low	UBUNTU-CVE-2026-89158	pcre2@10.39-3ubuntu0.1	no fix listed
Low	CGA-499w-m9q3-62x4	busybox@1.37.0-r57	1.37.0-r58
Low	UBUNTU-CVE-2026-26158	busybox@1:1.30.1-7ubuntu3.1	no fix listed
Low	DEBIAN-CVE-2026-5704	tar@1.35+dfsg-3.1	no fix listed
Low	GO-2026-4865	stdlib@go1.25.8	1.25.9
Low	GHSA-685w-q87j-wqw3	github.com/docker/distribution@v2.8.3+incompatible	no fix listed
Low	DEBIAN-CVE-2026-3184	util-linux@2.41.5-0+deb13u1	no fix listed
Low	GHSA-465g-fh3v-9jw4	github.com/rabbitmq/amqp091-go@v1.10.0	1.13.0
Low	ALPINE-CVE-2026-58055	nghttp2@1.69.0-r0	1.70.0-r0
Low	DEBIAN-CVE-2026-86138	libxml2@2.12.7+dfsg+really2.9.14-2.1+deb13u3	no fix listed
Low	GHSA-4mjr-xmp4-gh2g	qs@6.15.3	6.16.0
Low	CGA-3f47-cf69-q3c5	minio@0.20251015.172955-r10	0.20260504.002721-r1
Low	GO-2026-4976	stdlib@go1.25.8	1.25.10
Low	GHSA-9h8m-3fm2-qjrq	go.opentelemetry.io/otel/sdk@v1.37.0	1.40.0
Low	GO-2026-5039	stdlib@go1.25.10	1.25.11
Low	CGA-2cwp-3wv9-9xfr	busybox@1.37.0-r60	1.38.0-r0
Low	UBUNTU-CVE-2026-38753	busybox@1:1.30.1-7ubuntu3.1	no fix listed
Low	GO-2022-0646	github.com/aws/aws-sdk-go@v1.55.8	no fix listed
Low	ALPINE-CVE-2026-89156	pcre2@10.47-r0	10.48-r0
Low	DEBIAN-CVE-2011-3374	apt@3.0.3	no fix listed

Indexed versions

Version	Published	App version	Vulnerabilities	Radar Score
1.1.1latest	today	1.28.0	252501,091	15,638
1.0.0	2 days ago	1.28.0	252501,098	15,694

The latest version and the previous major, as selected nightly from the repository’s index.

README badge

[![Radar Score](https://charts.stackradar.io/badge/helmforge/openreplay.svg)](https://charts.stackradar.io/charts/helmforge/openreplay)

Markdown. The badge shows the latest version’s band and Radar Score, refreshed daily.