search

cnoe-io / idpbuilder

Spin up a complete internal developer platform with only Docker required as a dependency.
https://cloud-native.slack.com/archives/C05TN9WFN5S
Apache License 2.0
149 stars 45 forks source link

update docker dependency version to address CVE #294

Closed omrishiv closed 2 weeks ago

omrishiv commented 2 weeks ago 
~/code/idpbuilder-omri │ update-deps *1 !3  grype dir:. --exclude './bin/**' -o json                                                                                                                    
 ✔ Vulnerability DB                [no update available]  
 ✔ Indexed file system                                                                                                                                                                                                          .
 ✔ Cataloged contents                                                                                                                                            cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
   ├── ✔ Packages                        [124 packages]  
   └── ✔ Executables                     [0 executables]  
 ✔ Scanned for vulnerabilities     [1 vulnerability matches]  
   ├── by severity: 0 critical, 0 high, 1 medium, 0 low, 0 negligible
   └── by status:   1 fixed, 0 not-fixed, 0 ignored 
NAME                              INSTALLED             FIXED-IN  TYPE       VULNERABILITY        SEVERITY
github.com/docker/docker          v24.0.7+incompatible  24.0.9    go-module  GHSA-xw73-rw38-6vjc  Medium

I'm going to add automated scanning to Github action in another commit and we're also going to want to update the ./bins due to more CVEs if we can