Moby CVEs trivyignore #10438
Moby CVEs trivyignore #10438
Conversation
|
Visit the preview URL for this PR (updated for commit 1c7f3aa): https://gloo-edge--pr10438-bewebi-moby-trivyign-etuaq3gs.web.app (expires Thu, 19 Dec 2024 16:34:41 GMT) 🔥 via Firebase Hosting GitHub Action 🌎 Sign: 77c2b86e287749579b7ff9cadb81e099042ef677 |
|
The |
.trivyignore
Outdated
| # removed from all LTS branches | ||
| CVE-2024-36621 | ||
| CVE-2024-36623 |
There was a problem hiding this comment.
nit: should this file end with a new line?
| issueLink: https://github.com/solo-io/solo-projects/issues/7358 | ||
| - type: NON_USER_FACING | ||
| description: This also resolves the issue for 1.14 | ||
| issueLink: https://github.com/solo-io/solo-projects/issues/7359 |
There was a problem hiding this comment.
nit: should this file end with a new line?
|
I'm investigating the alternative solution proposed by @sam-heilbron here which may eliminate the need for this PR |
|
@bewebi are we safe to close this? |
|
We ran into complications backporting the EE CVE fix to 1.16 and, while that PR (solo-io/solo-projects#7396) is now passing CI, it required some dep bumps which may cause issues in 1.15 and 1.14 (eg bumping Go to 1.22) Therefore I'd advocate to leave this open until those backports are done and we know there is no need for this |
.trivyignore
Outdated
| # These are not expected to impact us and are difficult to resolve due to breaking API changes that impact our | ||
| # code | ||
| # While this has been resolved on v1.16+, backporting it to lower versions is complicated and we opted to skip it |
There was a problem hiding this comment.
should it be resolved in 1.17+ since we are reverting the fix in EE 1.16?
|
/kick |
Description
moby/mobyContext
See justification here
Notes for reviewers
This is marked as "work in progress" until consensus is reached on this path forward
Checklist:
BOT NOTES:
resolves https://github.com/solo-io/solo-projects/issues/7357
resolves https://github.com/solo-io/solo-projects/issues/7358
resolves https://github.com/solo-io/solo-projects/issues/7359