hyperledger / hyperledger/fabric

Request: Sync Docker Hub official images with latest dependency bumps (CVE fixes) on release-2.5 branch

Open
#5,489 1 comment 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Go
Stars
16.7k
Forks
9.1k
Avg merge
5h 38m
Merged PRs (30d)
26

Description

### Current Status

We have noticed that the `release-2.5` branch has recently received numerous dependency updates aimed at fixing various CVEs, largely thanks to the great contributions from @pfi79 who helped bump all of them. This is highly appreciated as security compliance is critical for enterprise production environments.

Additionally, we observed that the official `hyperledger/fabric-ca` image was updated on Docker Hub 4 days ago, successfully addressing a significant number of vulnerabilities (1 Critical / 60 High / 24 Medium / 8 Low).

However, the main Hyperledger Fabric core components (such as `fabric-peer`, `fabric-orderer`, etc.) for the v2.5 release line on Docker Hub do not seem to reflect these latest dependency updates yet.

### Expected

We would like to know if there are any technical blockers, CI/CD pipeline issues, or specific challenges currently delaying the shipment of these latest bumped dependency images to Docker Hub.

**Expected Outcome:**
* Having the official main Fabric images (`peer`, `orderer`, `tools`) built and published to Docker Hub in sync with the latest security fixes on the `release-2.5` branch.
* If there is a scheduled release plan or an ongoing blocker, please share it so the community can better align or potentially contribute to resolving it.

### Solution

_No response_

### Please let us know if you plan to work on this.

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.