Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Snyk] Security upgrade golang from 1.17.7-alpine to 1.18.7-alpine #207

Merged
merged 1 commit into from
Dec 15, 2022

Conversation

snyk-bot
Copy link

@snyk-bot snyk-bot commented Nov 9, 2022

Keeping your Docker base image up-to-date means you’ll benefit from security fixes in the latest version of your chosen image.

Changes included in this PR

  • Dockerfile

We recommend upgrading to golang:1.18.7-alpine, as this image has only 0 known vulnerabilities. To do this, merge this pull request, then verify your application still works as expected.

Some of the most important vulnerabilities in your base image include:

Severity Priority Score / 1000 Issue Exploit Maturity
high severity 400 Loop with Unreachable Exit Condition ('Infinite Loop')
SNYK-ALPINE315-LIBRETLS-2428776
No Known Exploit
high severity 400 Loop with Unreachable Exit Condition ('Infinite Loop')
SNYK-ALPINE315-OPENSSL-2426331
No Known Exploit
high severity 400 Loop with Unreachable Exit Condition ('Infinite Loop')
SNYK-ALPINE315-OPENSSL-2426331
No Known Exploit
high severity 400 Out-of-bounds Write
SNYK-ALPINE315-ZLIB-2434420
No Known Exploit
critical severity 500 Out-of-bounds Write
SNYK-ALPINE315-ZLIB-2976173
No Known Exploit

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings


Learn how to fix vulnerabilities with free interactive lessons:

🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.

@snyk-bot snyk-bot requested a review from a team as a code owner November 9, 2022 10:18
@CLAassistant
Copy link

CLAassistant commented Nov 9, 2022

CLA assistant check
All committers have signed the CLA.

@chenchanglew chenchanglew force-pushed the snyk-fix-61d8742ad190ca3d83e9a5aeab446ad1 branch from 738e6d2 to 692681c Compare November 9, 2022 10:20
@coveralls
Copy link

coveralls commented Nov 9, 2022

Pull Request Test Coverage Report for Build 3427288332

  • 0 of 0 changed or added relevant lines in 0 files are covered.
  • 3 unchanged lines in 1 file lost coverage.
  • Overall coverage decreased (-0.05%) to 56.825%

Files with Coverage Reduction New Missed Lines %
services/dkg/pedersen/handler.go 3 87.23%
Totals Coverage Status
Change from base Build 3412119124: -0.05%
Covered Lines: 3272
Relevant Lines: 5758

💛 - Coveralls

@sonarqubecloud
Copy link

sonarqubecloud bot commented Nov 9, 2022

Kudos, SonarCloud Quality Gate passed!    Quality Gate passed

Bug A 0 Bugs
Vulnerability A 0 Vulnerabilities
Security Hotspot A 0 Security Hotspots
Code Smell A 0 Code Smells

No Coverage information No Coverage information
0.0% 0.0% Duplication

@@ -3,7 +3,7 @@
##
## Build
##
FROM golang:1.17.7-alpine AS build
FROM golang:1.18.7-alpine AS build
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I believe there's a 1.18.8 version now. You might want to use that one.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think is because the other version also has some vulnerabilities.
image

@chenchanglew chenchanglew merged commit 422f212 into main Dec 15, 2022
@chenchanglew chenchanglew deleted the snyk-fix-61d8742ad190ca3d83e9a5aeab446ad1 branch December 15, 2022 14:12
@coveralls
Copy link

coveralls commented Sep 20, 2024

Pull Request Test Coverage Report for Build 3427288332

Warning: This coverage report may be inaccurate.

This pull request's base commit is no longer the HEAD commit of its target branch. This means it includes changes from outside the original pull request, including, potentially, unrelated coverage changes.

Details

  • 0 of 0 changed or added relevant lines in 0 files are covered.
  • 3 unchanged lines in 1 file lost coverage.
  • Overall coverage decreased (-0.05%) to 56.825%

Files with Coverage Reduction New Missed Lines %
services/dkg/pedersen/handler.go 3 87.23%
Totals Coverage Status
Change from base Build 3412119124: -0.05%
Covered Lines: 3272
Relevant Lines: 5758

💛 - Coveralls

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

6 participants