Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[FEATURE] Automatic Dependency Updates #114

Closed
pfuhrmann opened this issue Sep 15, 2023 · 2 comments
Closed

[FEATURE] Automatic Dependency Updates #114

pfuhrmann opened this issue Sep 15, 2023 · 2 comments
Assignees
Labels
feature New feature

Comments

@pfuhrmann
Copy link

pfuhrmann commented Sep 15, 2023

Is your feature request related to a problem? Please describe.
There are some CVEs always appearing in any image. It's important to keep the images up to date. This is somehow related to #108.

Describe the solution you'd like

  • Integrate Mend Renovate updates including auto-merge GitHub actions functionality to keep the image up to date.
  • Change Dockerfile base version to something more concrete to keep getting a fresh image every time patches are released. e.g. node:20.6.1-alpine3.18.
  • Release the new image version on every PR merge automatically.

Describe alternatives you've considered
The alternative is to keep the echo-server updated by hand. It's time-consuming for the authors. Another alternative is GitHub Dependabot, however, it does not come with the same "bells and whistles" as Renovate.

Additional context
The current CVE in ealen/echo-server:0.7.1: https://nvd.nist.gov/vuln/detail/CVE-2022-48174.

Base Score: 9.8 CRITICAL

@pfuhrmann pfuhrmann added the feature New feature label Sep 15, 2023
@Ealenn
Copy link
Owner

Ealenn commented Sep 17, 2023

Hello ! Thanks for this tools 🙏 I see some issues about security risk, for information I created this project mainly to test/simulate gateway on local or dev environments, so I'm not really worried about security. But isn't the case for all users (see #108) I will push another MR soon to rearrange this project accordingly to the different reports.

@pfuhrmann
Copy link
Author

Updates seems to be working nicely. Thank you for your hard work, this image is great!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
feature New feature
Projects
None yet
Development

No branches or pull requests

2 participants