-
Notifications
You must be signed in to change notification settings - Fork 1
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
BCDA-8240: Update dependencies to eliminate snyk vulnerabilities #181
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Looks good to me, ty!
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Looks good, one note, it seems as though the inclusion of binutils-gold with Alpine primarily supports x86-64 as per various links. Please keep in mind if moving to g/Graviton processors.
🎫 Ticket
https://jira.cms.gov/browse/BCDA-8240
🛠 Changes
Updated bcda-ssas-app to golang 1.19.12, as well as the alpine images and requisite dependencies to images supporting 1.22, as those are more recently utilized.
ℹ️ Context
Added binutils-gold in a dockerfile to ensure swagger can be built.
Changes were made in order to reduce the number of snyk vulnerabilities, including eliminating some of the critical vulnerabilities shown at: https://app.snyk.io/org/bcda/project/b185bf9a-b24d-4ac1-a892-6759ab92bc56 and https://app.snyk.io/org/bcda/project/2830ab17-cf13-4780-a2f2-51259a8526d0
If any of the following security implications apply, this PR must not be merged without Stephen Walter's approval. Explain in this section and add @SJWalter11 as a reviewer.
🧪 Validation
make test -> passes
Passes snyk tests and CI tests on github.