search

atomist-skills / npm-vulnerability-scanner-skill

Atomist Skill to find and fix security vulnerabilities in npm dependencies
Apache License 2.0
0 stars 0 forks source link

Pin Docker base images in Dockerfile #157

Closed atomist[bot] closed 3 years ago

atomist[bot] commented 3 years ago

This pull request pins the following Docker base images in Dockerfile to their current digests.

 2: FROM node:lts@sha256:359104ed81c918c2ca3bfb01faa069e33949013fde25c6a471b0fa27d19d78ca 
12: FROM node:lts@sha256:359104ed81c918c2ca3bfb01faa069e33949013fde25c6a471b0fa27d19d78ca

Pinning FROM lines to digests makes your builds repeatable. Atomist will raise new pull requests whenever the tag moves, so that you know when the base image has been updated. You can follow a new tag at any time. Just replace the digest with the new tag you want to follow. Atomist, will switch to following this new tag.

File changed:

atomist/docker-base-image-policy · Configure

atomist[bot] commented 3 years ago

badge

This pull request removes 11 vulnerabilities compared to main branch 4819828.

Detected a total of 7 (-1) critical, 63 (-3) high and 79 (-7) medium vulnerabilities in Docker image gcr.io/atomist-container-skills/npm-vulnerability-scanner-skill@sha256:baabd78c90d67659656e23bd49e172ae29673207a5a89f0185114b19f5871bd6.

More details are available in the report.