search

atomist-skills / npm-vulnerability-scanner-skill

Atomist Skill to find and fix security vulnerabilities in npm dependencies
Apache License 2.0
0 stars 0 forks source link

Re-pin Docker base image in Dockerfile #260

Closed atomist[bot] closed 3 years ago

atomist[bot] commented 3 years ago

This pull request re-pins the Docker base image atomist/skill:node14 in Dockerfile to the current digest.

https://github.com/atomist-skills/npm-vulnerability-scanner-skill/blob/9a9493125781e4a47f6625bc889e272d1e6831c4/Dockerfile#L12-L12

Changelog for atomist/skill:node14

### Commit New image build caused by commit atomist-skills/skill-base@5254f8bf768b79e78ad1952d6fe7b7ee0a337c82 to [`Dockerfile`](https://github.com/atomist-skills/skill-base/blob/5254f8bf768b79e78ad1952d6fe7b7ee0a337c82/Dockerfile): ``` Prettier fixes (#46) * Prettier format fixes [atomist:generated] [atomist-skill:atomist/prettier-skill] Pull request auto merged: * No reviews * 1 successful check ``` --- ### Comparison Comparing Docker image `atomist/skill:node14` at digests _Current_ `sha256:c58582642c85f2767523a3b65cbddd41f50814c98fe1c805b44c8caf5f0ad89e` (641mb) and _Proposed_ `sha256:ec317995ddbcdea37dd3cd9919196d3e13bb47258d21a163b87a38bd6a06fa86` (646mb): #### Packages The following package differences were detected: | Name | Current | Proposed | Type | | ---- | ------- | -------- | ---- | | `libcurl3-gnutls` | `7.74.0-1ubuntu2.1` | `7.74.0-1ubuntu2.3` | Apt | | `libgcrypt20` | `1.8.7-2ubuntu2` | `1.8.7-2ubuntu2.1` | Apt | | `libgd3` | `2.3.0-2` | `2.3.0-2ubuntu0.1` | Apt | | `linux-libc-dev` | `5.11.0-31.33` | `5.11.0-34.36` | Apt | #### Files The following file modifications were detected: | Name | Current | Proposed | Diff | | ---- | ------- | -------- | ---- | | `/root/.config/configstore/update-notifier-npm.json` | `55b` | `55b` | `0b` | | `/usr/include/linux/in.h` | `9.9kb` | `10kb` | `137b` | | `/usr/include/linux/input-event-codes.h` | `28kb` | `28kb` | `71b` | | `/usr/include/x86_64-linux-gnu/asm/hwcap2.h` | `294b` | `324b` | `30b` | | `/usr/lib/node_modules/@atomist/skill/node_modules/@babel` (316 files changed) | `13mb` | `13mb` | `-64kb` | | `/usr/lib/node_modules/@atomist/skill/node_modules/@google-cloud` (39 files changed) | `729kb` | `740kb` | `11kb` | | `/usr/lib/node_modules/@atomist/skill/node_modules/@graphql-tools` (31 files changed) | `1.6mb` | `2.0mb` | `428kb` | | `/usr/lib/node_modules/@atomist/skill/node_modules/@grpc` (2 files changed) | `35kb` | `36kb` | `1.4kb` | | `/usr/lib/node_modules/@atomist/skill/node_modules/@octokit` (43 files changed) | `2.9mb` | `2.9mb` | `23kb` | | `/usr/lib/node_modules/@atomist/skill/node_modules/@types` (48 files changed) | `1.6mb` | `1.6mb` | `5.4kb` | | `/usr/lib/node_modules/@atomist/skill/node_modules/ansi-regex` (3 files changed) | `5.1kb` | `5.0kb` | `-83b` | | `/usr/lib/node_modules/@atomist/skill/node_modules/browserslist` (3 files changed) | `33kb` | `34kb` | `1.1kb` | | `/usr/lib/node_modules/@atomist/skill/node_modules/call-bind/package.json` | `3.0kb` | `3.1kb` | `46b` | | `/usr/lib/node_modules/@atomist/skill/node_modules/caniuse-lite` (793 files changed) | `1.3mb` | `1.4mb` | `152kb` | | `/usr/lib/node_modules/@atomist/skill/node_modules/cliui/package.json` | `3.1kb` | `3.1kb` | `0b` | | `/usr/lib/node_modules/@atomist/skill/node_modules/colorette` (3 files changed) | `7.0kb` | `7.0kb` | `55b` | | `/usr/lib/node_modules/@atomist/skill/node_modules/cross-fetch` (8 files changed) | | `+` | `585kb` | | `/usr/lib/node_modules/@atomist/skill/node_modules/electron-to-chromium` (4 files changed) | `66kb` | `68kb` | `1.5kb` | | `/usr/lib/node_modules/@atomist/skill/node_modules/es-abstract` (29 files changed) | `97kb` | `96kb` | `-930b` | | `/usr/lib/node_modules/@atomist/skill/node_modules/fastq` (5 files changed) | `20kb` | `22kb` | `1.7kb` | | `/usr/lib/node_modules/@atomist/skill/node_modules/gaxios` (4 files changed) | `32kb` | `33kb` | `440b` | | `/usr/lib/node_modules/@atomist/skill/node_modules/gcp-metadata` (3 files changed) | `33kb` | `33kb` | `67b` | | `/usr/lib/node_modules/@atomist/skill/node_modules/gcs-resumable-upload` (11 files changed) | `195kb` | `199kb` | `4.7kb` | | `/usr/lib/node_modules/@atomist/skill/node_modules/get-intrinsic/package.json` | `3.1kb` | `3.1kb` | `46b` | | `/usr/lib/node_modules/@atomist/skill/node_modules/get-symbol-description` (11 files changed) | | `+` | `25kb` | | `/usr/lib/node_modules/@atomist/skill/node_modules/git-url-parse` (3 files changed) | `28kb` | `29kb` | `367b` | | `/usr/lib/node_modules/@atomist/skill/node_modules/google-gax` (196 files changed) | `1.3mb` | `4.7mb` | `3.4mb` | | `/usr/lib/node_modules/@atomist/skill/node_modules/graphql` (11 files changed) | `161kb` | `161kb` | `445b` | | `/usr/lib/node_modules/@atomist/skill/node_modules/inquirer/package.json` | `2.4kb` | `2.4kb` | `0b` | | `/usr/lib/node_modules/@atomist/skill/node_modules/is-callable/package.json` | `3.2kb` | `3.2kb` | `0b` | | `/usr/lib/node_modules/@atomist/skill/node_modules/is-regex/package.json` | `3.2kb` | `3.2kb` | `0b` | | `/usr/lib/node_modules/@atomist/skill/node_modules/is-string/package.json` | `3.2kb` | `3.2kb` | `0b` | | `/usr/lib/node_modules/@atomist/skill/node_modules/jose` (95 files changed) | `268kb` | `270kb` | `1.3kb` | | `/usr/lib/node_modules/@atomist/skill/node_modules/listr-verbose-renderer/package.json` | `2.1kb` | `2.1kb` | `0b` | | `/usr/lib/node_modules/@atomist/skill/node_modules/log-update/package.json` | `1.9kb` | `1.9kb` | `0b` | | `/usr/lib/node_modules/@atomist/skill/node_modules/map-obj` (4 files changed) | `7.8kb` | `9.3kb` | `1.4kb` | | `/usr/lib/node_modules/@atomist/skill/node_modules/mime-db` (3 files changed) | `194kb` | `195kb` | `815b` | | `/usr/lib/node_modules/@atomist/skill/node_modules/mime-types` (6 files changed) | | `+` | `597kb` | | `/usr/lib/node_modules/@atomist/skill/node_modules/node-fetch` (5 files changed) | `134kb` | `125kb` | `-8.5kb` | | `/usr/lib/node_modules/@atomist/skill/node_modules/node-releases` (3 files changed) | `234kb` | `236kb` | `2.4kb` | | `/usr/lib/node_modules/@atomist/skill/node_modules/prettier` (31 files changed) | `19mb` | `20mb` | `275kb` | | `/usr/lib/node_modules/@atomist/skill/node_modules/proto3-json-serializer` (10 files changed) | `33kb` | `34kb` | `850b` | | `/usr/lib/node_modules/@atomist/skill/node_modules/relay-compiler/package.json` | `2.3kb` | `2.3kb` | `0b` | | `/usr/lib/node_modules/@atomist/skill/node_modules/signal-exit` (4 files changed) | `8.7kb` | `8.0kb` | `-662b` | | `/usr/lib/node_modules/@atomist/skill/node_modules/source-map-support` (3 files changed) | `73kb` | `74kb` | `643b` | | `/usr/lib/node_modules/@atomist/skill/node_modules/string-width/package.json` | `2.4kb` | `2.4kb` | `0b` | | `/usr/lib/node_modules/@atomist/skill/node_modules/strip-ansi` (3 files changed) | `4.3kb` | `4.4kb` | `36b` | | `/usr/lib/node_modules/@atomist/skill/node_modules/teeny-request` (2 files changed) | `12kb` | `12kb` | `334b` | | `/usr/lib/node_modules/@atomist/skill/node_modules/tr46` (5 files changed) | | `+` | `780kb` | | `/usr/lib/node_modules/@atomist/skill/node_modules/uglify-js` (6 files changed) | `803kb` | `804kb` | `1.3kb` | | `/usr/lib/node_modules/@atomist/skill/node_modules/webidl-conversions` (4 files changed) | | `+` | `31kb` | | `/usr/lib/node_modules/@atomist/skill/node_modules/whatwg-url` (8 files changed) | | `+` | `141kb` | | `/usr/lib/node_modules/@atomist/skill/node_modules/wrap-ansi/package.json` | `2.2kb` | `2.2kb` | `0b` | | `/usr/lib/python3.9/__pycache__/_markupbase.cpython-39.pyc` | `7.6kb` | `7.6kb` | `0b` | | `/usr/lib/python3.9/__pycache__/difflib.cpython-39.pyc` | `58kb` | `58kb` | `0b` | | `/usr/lib/python3.9/__pycache__/ftplib.cpython-39.pyc` | `28kb` | `28kb` | `0b` | | `/usr/lib/python3.9/__pycache__/gettext.cpython-39.pyc` | `18kb` | `18kb` | `0b` | | `/usr/lib/python3.9/__pycache__/hashlib.cpython-39.pyc` | `6.5kb` | `6.5kb` | `0b` | | `/usr/lib/python3.9/__pycache__/mailbox.cpython-39.pyc` | `59kb` | `59kb` | `0b` | | `/usr/lib/python3.9/__pycache__/netrc.cpython-39.pyc` | `3.7kb` | `3.7kb` | `0b` | | `/usr/lib/python3.9/__pycache__/nntplib.cpython-39.pyc` | `31kb` | `31kb` | `0b` | | `/usr/lib/python3.9/__pycache__/pathlib.cpython-39.pyc` | `44kb` | `44kb` | `0b` | | `/usr/lib/python3.9/__pycache__/pydoc.cpython-39.pyc` | `83kb` | `83kb` | `0b` | | `/usr/lib/python3.9/__pycache__/rlcompleter.cpython-39.pyc` | `5.6kb` | `5.6kb` | `0b` | | `/usr/lib/python3.9/__pycache__/socket.cpython-39.pyc` | `28kb` | `28kb` | `0b` | | `/usr/lib/python3.9/__pycache__/tarfile.cpython-39.pyc` | `62kb` | `62kb` | `0b` | | `/usr/lib/python3.9/__pycache__/typing.cpython-39.pyc` | `70kb` | `70kb` | `0b` | | `/usr/lib/python3.9/__pycache__/zipfile.cpython-39.pyc` | `58kb` | `58kb` | `0b` | | `/usr/lib/python3.9/asyncio/__pycache__/__main__.cpython-39.pyc` | `3.1kb` | `3.1kb` | `0b` | | `/usr/lib/python3.9/http/__pycache__/client.cpython-39.pyc` | `34kb` | `34kb` | `0b` | | `/usr/lib/python3.9/test/__pycache__/test_support.cpython-39.pyc` | `21kb` | `21kb` | `0b` | | `/usr/lib/python3.9/unittest/__pycache__/mock.cpython-39.pyc` | `76kb` | `76kb` | `0b` | | `/usr/lib/python3.9/wsgiref/__pycache__/handlers.cpython-39.pyc` | `16kb` | `16kb` | `0b` | | `/usr/lib/python3.9/wsgiref/__pycache__/util.cpython-39.pyc` | `5.3kb` | `5.3kb` | `0b` | | `/usr/lib/x86_64-linux-gnu/libcurl-gnutls.so.4.7.0` | `610kb` | `610kb` | `0b` | | `/usr/lib/x86_64-linux-gnu/libgcrypt.so.20.2.8` | `1.1mb` | `1.1mb` | `4.2kb` | | `/usr/lib/x86_64-linux-gnu/libgd.so.3.0.8` | `401kb` | `397kb` | `-4.0kb` | | `/usr/share/doc/libcurl3-gnutls/changelog.Debian.gz` | `1.9kb` | `2.1kb` | `200b` | | `/usr/share/doc/libgcrypt20/changelog.Debian.gz` | `1.4kb` | `1.1kb` | `-237b` | | `/usr/share/doc/libgd3/changelog.Debian.gz` | `1.2kb` | `1.3kb` | `90b` | | `/usr/share/doc/linux-libc-dev/changelog.Debian.gz` | `61kb` | `49kb` | `-11kb` | | `/var/cache/ldconfig/aux-cache` | `9.9kb` | `9.9kb` | `0b` | | `/var/lib/apt/extended_states` | `8.8kb` | `8.7kb` | `-118b` | | `/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums` | `398b` | `398b` | `0b` | | `/var/lib/dpkg/info/libgcrypt20:amd64.md5sums` | `508b` | `508b` | `0b` | | `/var/lib/dpkg/info/libgcrypt20:amd64.triggers` | `74b` | `74b` | `0b` | | `/var/lib/dpkg/info/libgd3:amd64.md5sums` | `283b` | `283b` | `0b` | | `/var/lib/dpkg/info/libgd3:amd64.triggers` | `70b` | `74b` | `4b` | | `/var/lib/dpkg/info/linux-libc-dev:amd64.md5sums` | `61kb` | `61kb` | `0b` | | `/var/lib/dpkg/status` | `235kb` | `235kb` | `11b` | | `/var/lib/dpkg/status-old` | `235kb` | `235kb` | `11b` | | `/var/log/alternatives.log` | `9.1kb` | `9.1kb` | `0b` | | `/var/log/apt/eipp.log.xz` | `11kb` | `11kb` | `-4b` | | `/var/log/apt/history.log` | `24kb` | `24kb` | `249b` | | `/var/log/apt/term.log` | `41kb` | `42kb` | `959b` | | `/var/log/dpkg.log` | `225kb` | `226kb` | `1.1kb` | #### History The following differences in [`docker history`](https://docs.docker.com/engine/reference/commandline/history/) were detected: ```diff /bin/sh -c #(nop) ADD file:4ac73e113682ef48b7466c4f8765ca7fd54ae98228caa319438a76c35d762b1b in / /bin/sh -c #(nop) CMD ["bash"] RUN apt-get update && apt-get install -y git=1:2.30.2-1ubuntu1 && apt-get clean -y && rm -rf /var/cache/apt /var/lib/apt/lists/* /tmp/* /var/tmp/* -RUN apt-get update && apt-get install -y build-essential=12.8ubuntu3 curl=7.74.0-1ubuntu2.1 && curl -sL https://deb.nodesource.com/setup_14.x | bash - && apt-get update && apt-get install -y nodejs=14.17.6-deb-1nodesource1 && apt-get remove -y curl && apt-get autoremove -y && apt-get clean -y && rm -rf /var/cache/apt /var/lib/apt/lists/* /tmp/* /var/tmp/* +RUN apt-get update && apt-get install -y build-essential=12.8ubuntu3 curl=7.74.0-1ubuntu2.3 && curl -sL https://deb.nodesource.com/setup_14.x | bash - && apt-get update && apt-get install -y nodejs=14.17.6-deb-1nodesource1 && apt-get remove -y curl && apt-get autoremove -y && apt-get clean -y && rm -rf /var/cache/apt /var/lib/apt/lists/* /tmp/* /var/tmp/* RUN npm install -g @atomist/skill@0.11.0 && rm -rf /root/.npm/ +RUN apt-get update && apt-get install -y linux-libc-dev=5.11.0-34.36 libgcrypt20=1.8.7-2ubuntu2.1 libgd3=2.3.0-2ubuntu0.1 && apt-get clean -y && rm -rf /var/cache/apt /var/lib/apt/lists/* /tmp/* /var/tmp/* ``` #### Ports No different exposed ports detected #### Environment Variables No different environment variables detected

Pinning FROM lines to digests makes your builds repeatable. Atomist will raise new pull requests whenever the tag moves, so that you know when the base image has been updated. You can follow a new tag at any time. Just replace the digest with the new tag you want to follow. Atomist, will switch to following this new tag.

File changed:

atomist[bot] commented 3 years ago
Vulnerabilities
Comparison

🎉 Fixes 16 high severity vulnerabilities compared with target branch main 🎉 Fixes 16 high severity vulnerabilities compared with unstable

💡 Rebase branch atomist/pin-docker-base-image/dockerfile to include latest changes from branch main to increase accuracy of vulnerability report

More details are available in the vulnerability report