Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

BCDA-8240: Update dependencies to eliminate snyk vulnerabilities #181

Merged
merged 12 commits into from
Jul 29, 2024

Conversation

alex-dzeda
Copy link
Contributor

@alex-dzeda alex-dzeda commented Jul 19, 2024

🎫 Ticket

https://jira.cms.gov/browse/BCDA-8240

🛠 Changes

Updated bcda-ssas-app to golang 1.19.12, as well as the alpine images and requisite dependencies to images supporting 1.22, as those are more recently utilized.

ℹ️ Context

Added binutils-gold in a dockerfile to ensure swagger can be built.

Changes were made in order to reduce the number of snyk vulnerabilities, including eliminating some of the critical vulnerabilities shown at: https://app.snyk.io/org/bcda/project/b185bf9a-b24d-4ac1-a892-6759ab92bc56 and https://app.snyk.io/org/bcda/project/2830ab17-cf13-4780-a2f2-51259a8526d0

If any of the following security implications apply, this PR must not be merged without Stephen Walter's approval. Explain in this section and add @SJWalter11 as a reviewer.

  • Adds a new software dependency or dependencies. -> binutils-gold added to Dockerfile.ssas

🧪 Validation

make test -> passes
Passes snyk tests and CI tests on github.

@alex-dzeda alex-dzeda changed the title BCDA-8420: Update dependencies to BCDA-8420: Update dependencies to eliminate snyk vulnerabilities Jul 22, 2024
@alex-dzeda alex-dzeda marked this pull request as ready for review July 23, 2024 15:34
Copy link
Contributor

@kyeah kyeah left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good to me, ty!

@alex-dzeda alex-dzeda changed the title BCDA-8420: Update dependencies to eliminate snyk vulnerabilities BCDA-8240: Update dependencies to eliminate snyk vulnerabilities Jul 29, 2024
Copy link
Collaborator

@SJWalter11 SJWalter11 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good, one note, it seems as though the inclusion of binutils-gold with Alpine primarily supports x86-64 as per various links. Please keep in mind if moving to g/Graviton processors.

@alex-dzeda alex-dzeda merged commit 6128425 into main Jul 29, 2024
5 checks passed
@alex-dzeda alex-dzeda deleted the alex/bcda-8420 branch July 29, 2024 20:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants