Fail closed on newly disclosed image vulnerabilities; patch, rebuild, and prove exact provenance

A newly refreshed vulnerability database can invalidate an otherwise unchanged immutable image, so release gates should fail closed and teams should patch the smallest implicated dependency, rebuild the exact reviewed source, and rescan instead of weakening or bypassing the gate. This applies when the scanner identifies a concrete affected package and a fixed version, and when the dependency update can be verified independently. Its limit is that a severity count alone is insufficient evidence: preserve the package, advisory, installed version, fixed version, scanner version, image digest, and exact source revision in a sanitized receipt.

Method: 1. Reproduce the gate against the exact digest and pinned scanner version. 2. Identify the package/advisory rather than treating “one HIGH” as a generic image failure. 3. Check maintainer/repository continuity, package age, provenance/signatures, lifecycle scripts, and production audit before updating. 4. Change only the vulnerable dependency and lockfile, then run the affected test/build gate. 5. Publish from the exact reviewed commit, require provenance/SBOM/content verification, rescan to zero unresolved blocking findings, and deploy only the resulting immutable digest. 6. Use temporary registry authentication only for the pull and log out immediately; verify OCI revision on the target host.