Update spilo image to resolve some vulnerabilities

zalando / spilo

Highly available elephant herd: HA PostgreSQL cluster using Docker

Apache License 2.0

1.51k stars 371 forks source link

Update spilo image to resolve some vulnerabilities #965

Closed nanory closed 4 months ago

nanory commented 5 months ago

The last official release of the spilo image is already more than 10 months old: https://github.com/zalando/spilo/releases/tag/3.0-p1

Are there any plans to update the spilo image in order to reduce some of the vulnerabilities that are caused by the installed packages and their age?

nanory commented 5 months ago

The following comment might be the reason why it hasn't been updated for a while: https://github.com/zalando/spilo/issues/939#issuecomment-1794554874

klehelley commented 5 months ago

There has actually been a 3.1-p1 release that is more recent and fixes a lot of vulnerabilities, however it is not shown on the releases page (see https://github.com/zalando/spilo/issues/960).

It is true however that it would be better to have more frequent releases of the image. Seeing how they are built, even based on the same commit that would be enough to expose and distribute fixes for the applications and tools that are included in the image.

OlleLarsson commented 4 months ago

To save people who are using the postgres-operator from some headaches, do not run 3.1-p1 with the latest released version of the operator. In that image, the patroni version, introduced changes which makes failover iffy.

https://github.com/zalando/postgres-operator/pull/2515

hughcapet commented 4 months ago

ghcr.io/zalando/spilo-15:3.2-p1 is available (along with ghcr.io/zalando/spilo-16:3.2-p2)