Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Quay.io vulnerability scanner fixes #1788

Open
wants to merge 3 commits into
base: master
Choose a base branch
from

Conversation

tsebastiani
Copy link

@tsebastiani tsebastiani commented May 29, 2024

oc CLI has an important role in our project and we ship it inside our container images. We've noticed that some of the dependencies contained in the tool are rising several vulnerabilities of various severities that prevent our users to run the project in mission critical environments.
With this PR we introduced mainly some version bumps and small adaptations to the newer version when a breaking change occured:

  • github.com/aws/aws-sdk-go v1.45.20 -> v1.53.11 [severity: Unknown] GO-2022-0646: brought the library to the latest version, unfortunately this does not solve the issue ❌
  • github.com/containers/image/v5 v5.29.0 -> v5.30.1 [severity: High] GHSA-6wvf-f2vw-3425 fixed ✅
  • github.com/docker/docker v24.0.7+incompatible -> v25.0.5+incompatible [severity: High] GHSA-6wvf-f2vw-3425 fixed ✅
  • github.com/opencontainers/runc v1.1.10 -> v1.1.12 [severity: High] GHSA-xr7r-f8xq-vfvv fixed ✅
  • golang.org/x/net v0.20.0 -> v0.23.0 [severity: Medium] GHSA-4v7x-pqxf-cx7m fixed ✅

@openshift-ci openshift-ci bot requested review from coreydaley and mfojtik May 29, 2024 14:59
Copy link
Contributor

openshift-ci bot commented May 29, 2024

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: tsebastiani
Once this PR has been reviewed and has the lgtm label, please assign ardaguclu for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@tsebastiani
Copy link
Author

/retest

1 similar comment
@tsebastiani
Copy link
Author

/retest

@tsebastiani
Copy link
Author

/retest-required

Copy link
Contributor

openshift-ci bot commented May 30, 2024

@tsebastiani: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/e2e-metal-ipi-ovn-ipv6 f386bc4 link false /test e2e-metal-ipi-ovn-ipv6

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@tsebastiani
Copy link
Author

/retest-required

@openshift-merge-robot openshift-merge-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jun 4, 2024
@openshift-merge-robot
Copy link
Contributor

PR needs rebase.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@openshift-bot
Copy link
Contributor

Issues go stale after 90d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle stale

@openshift-ci openshift-ci bot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Sep 3, 2024
@openshift-bot
Copy link
Contributor

Stale issues rot after 30d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.
Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle rotten
/remove-lifecycle stale

@openshift-ci openshift-ci bot added lifecycle/rotten Denotes an issue or PR that has aged beyond stale and will be auto-closed. and removed lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. labels Oct 3, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
lifecycle/rotten Denotes an issue or PR that has aged beyond stale and will be auto-closed. needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants