[FEAT] Fix vulnerable packages.

linuxserver / docker-nextcloud

GNU General Public License v3.0

678 stars 128 forks source link

[FEAT] Fix vulnerable packages. #378

Closed bogdanioanliviu closed 7 months ago

bogdanioanliviu commented 7 months ago

Is this a new feature request?

[X] I have searched the existing issues

Wanted change

Update the following: ghostscript to 10.02.0-r0 imagemagick to 7.1.1.13-r1

as the existing versions are vulnerable

Reason for change

Fix and improve vulnerability of the image

Proposed code change

Execute ask update && ask -U upgrade on every image creation

github-actions[bot] commented 7 months ago

Thanks for opening your first issue here! Be sure to follow the relevant issue templates, or risk having this issue marked as invalid.

thespad commented 7 months ago

Every build uses the latest packages available at build time and we run weekly package checks to identify any packages that have changed in-between upstream releases.

The last build was 4 days ago and the releases you're referencing were published less than 4 days ago so obviously cannot be on the currently published image. When the next package check or upstream releases build is triggered, it will incorporable the updated versions.