Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[chore] update packages to fix trivy vulnerability scan #1508

Merged
merged 1 commit into from
Aug 26, 2022

Conversation

hookenz
Copy link
Contributor

@hookenz hookenz commented Jun 13, 2022

Trivy reports a long list of vulnerabilities. See issue here: #1507

After updating packages in go.mod, trivy now shows the following output:

❯ trivy fs .                        
2022-06-13T15:08:58.314+1200	INFO	Number of language-specific files: 2
2022-06-13T15:08:58.314+1200	INFO	Detecting bundler vulnerabilities...
2022-06-13T15:08:58.314+1200	INFO	Detecting gomod vulnerabilities...

docs/Gemfile.lock (bundler)

Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0)


go.mod (gomod)

Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0)

It wasn't exactly straight forward. I had to add some overrides!

@k8s-ci-robot k8s-ci-robot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. labels Jun 13, 2022
@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: hookenz
To complete the pull request process, please assign cdrage after the PR has been reviewed.
You can assign the PR to them by writing /assign @cdrage in a comment when ready.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@hookenz hookenz changed the title update packages to fix trivy vulnerability scan [chore] update packages to fix trivy vulnerability scan Jun 13, 2022
Copy link
Contributor Author

@hookenz hookenz left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can go be updated? 1.13 is quite old and to fix the security issues we need newer packages that depend on newer versions of go.

Copy link
Contributor Author

@hookenz hookenz left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/assign @cdrage

@cdrage
Copy link
Member

cdrage commented Aug 26, 2022

Thank you so much! I can confirm that this compiles and works well.

Sorry about the delay, the project has long been in "maintenance" mode.

Unfortunately I do not have the bandwidth to update to the newest Go version only because there was compiling issues with the most up to date version with Kompose. But I'll merge this PR in and thanks again for the fixes!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. size/XL Denotes a PR that changes 500-999 lines, ignoring generated files.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants