mittwald / mittwald/kube-httpcache
Update Dependencies to resolve known CVEs
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 313
- Forks
- 82
- PR merge metrics
- No merged PRs in 30d
Description
Describe the bug
There are several known CVEs found within the dependencies of the stable image.
https://quay.io/repository/mittwald/kube-httpcache/manifest/sha256:ed153b482be398b8d979cf4983b1936a97ca734837aac588e4e5e2f3fca58cbe?tab=vulnerabilities&fixable=true
To Reproduce
Use Docker Scout or a similar CVE scanner to check the stable image.
Expected behavior
It's not entirely unreasonable for there to be some CVEs found within the dependencies, but since there hasn't been an update to the image in 7 months many of these vulnerabilities are likely very easily fixed with some dependency bumps.
Perhaps dependabot or a similar tool with some CI steps to automate the deployments could help reduce the time cost with updating the images moving forward keeping this project healthier?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by running Docker Scout or a similar CVE scanner against the stable image and review the linked Quay vulnerability report. Trace the affected dependencies in this Go/Kubernetes project; done means dependency updates produce a refreshed stable image with the reported fixable CVEs addressed.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, go, kubernetes
- Domain
- devops, infrastructure, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100