search

edgexfoundry / app-functions-sdk-go

Owner: Applications WG
Apache License 2.0
43 stars 81 forks source link

Bump dependencies to resolve CVEs in napa branch #1583

Open cloudxxx8 opened 4 months ago

cloudxxx8 commented 4 months ago

Some old depedencies should be upgraded to resolve CVEs

cloud@cloud-VirtualBox:~/EdgeX/edgex-compose$ docker scout cves --format only-packages --only-vuln-packages edgexfoundry/app-service-configurable:3.1.0

    i New version 1.8.0 available (installed version is 1.7.0) at https://github.com/docker/scout-cli

    ✓ Image stored for indexing

    ✓ Indexed 84 packages

    ✗ Detected 6 vulnerable packages with a total of 23 vulnerabilities

              Name               Version    Type            Vulnerabilities            

──────────────────────────────────────────────────────────────────────────────────────────

  github.com/go-jose/go-jose/v3  3.0.0     golang     0C     0H     2M     0L     1?   

  golang.org/x/crypto            0.14.0    golang     0C     0H     1M     0L          

  golang.org/x/net               0.17.0    golang     0C     0H     1M     0L          

  google.golang.org/protobuf     1.30.0    golang     0C     0H     1M     0L          

  openssl                        3.1.4-r1  apk        0C     0H     2M     0L     2?   

  stdlib                         1.21.0    golang     0C     4H     4M     0L     6?