hyperledger / hyperledger/fabric
Request: Sync Docker Hub official images with latest dependency bumps (CVE fixes) on release-2.5 branch
- Dominant language
- Go
- Stars
- 16.7k
- Forks
- 9.1k
- Avg merge
- 5h 38m
- Merged PRs (30d)
- 26
Description
### Current Status
We have noticed that the `release-2.5` branch has recently received numerous dependency updates aimed at fixing various CVEs, largely thanks to the great contributions from @pfi79 who helped bump all of them. This is highly appreciated as security compliance is critical for enterprise production environments.
Additionally, we observed that the official `hyperledger/fabric-ca` image was updated on Docker Hub 4 days ago, successfully addressing a significant number of vulnerabilities (1 Critical / 60 High / 24 Medium / 8 Low).
However, the main Hyperledger Fabric core components (such as `fabric-peer`, `fabric-orderer`, etc.) for the v2.5 release line on Docker Hub do not seem to reflect these latest dependency updates yet.
### Expected
We would like to know if there are any technical blockers, CI/CD pipeline issues, or specific challenges currently delaying the shipment of these latest bumped dependency images to Docker Hub.
**Expected Outcome:**
* Having the official main Fabric images (`peer`, `orderer`, `tools`) built and published to Docker Hub in sync with the latest security fixes on the `release-2.5` branch.
* If there is a scheduled release plan or an ongoing blocker, please share it so the community can better align or potentially contribute to resolving it.
### Solution
_No response_
### Please let us know if you plan to work on this.
_No response_
Contributor guide
Assessment
This issue has not been assessed yet.