Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

[Snyk] Security upgrade python from 3.9-slim to 3.13-slim #176

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

bluet
Copy link
Owner

@bluet bluet commented Oct 23, 2024

snyk-top-banner

Snyk has created this PR to fix 3 vulnerabilities in the dockerfile dependencies of this project.

Keeping your Docker base image up-to-date means you’ll benefit from security fixes in the latest version of your chosen image.

Snyk changed the following file(s):

  • Dockerfile

We recommend upgrading to python:3.13-slim, as this image has only 37 known vulnerabilities. To do this, merge this pull request, then verify your application still works as expected.

Vulnerabilities that will be fixed with an upgrade:

Issue Score
critical severity Integer Overflow or Wraparound
SNYK-DEBIAN12-ZLIB-6008963
  500  
low severity CVE-2023-50495
SNYK-DEBIAN12-NCURSES-6123823
  150  
low severity CVE-2023-50495
SNYK-DEBIAN12-NCURSES-6123823
  150  
low severity CVE-2023-45918
SNYK-DEBIAN12-NCURSES-6252773
  150  
low severity CVE-2023-45918
SNYK-DEBIAN12-NCURSES-6252773
  150  

Important

  • Check the changes in this PR to ensure they won't cause issues with your project.
  • Max score is 1000. Note that the real score may have changed since the PR was raised.
  • This PR was automatically created by Snyk using the credentials of a real user.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic


Learn how to fix vulnerabilities with free interactive lessons:

🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.


Important

Upgrade Dockerfile base image to python:3.13-slim to fix security vulnerabilities.

  • Dockerfile Update:
    • Upgrade base image from python:3.9-slim to python:3.13-slim to address security vulnerabilities.
    • Fixes vulnerabilities: Integer Overflow in zlib and issues in ncurses.
  • Security:
    • Reduces known vulnerabilities from previous image version.
  • Verification:
    • Ensure application compatibility with python:3.13-slim.

This description was created by Ellipsis for bb8392b. It will automatically update as commits are pushed.

Copy link

@ellipsis-dev ellipsis-dev bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍 Looks good to me! Reviewed everything up to bb8392b in 10 seconds

More details
  • Looked at 10 lines of code in 1 files
  • Skipped 0 files when reviewing.
  • Skipped posting 1 drafted comments based on config settings.
1. Dockerfile:1
  • Draft comment:
    Ensure that all dependencies and the application are compatible with Python 3.13, as this is a major version upgrade from 3.9.
  • Reason this comment was not posted:
    Confidence changes required: 50%
    The upgrade to Python 3.13-slim is a significant jump from 3.9-slim. This could potentially introduce compatibility issues with existing code or dependencies. It's important to ensure that all dependencies and the application itself are compatible with Python 3.13.

Workflow ID: wflow_42TgQXodtSQjNAdQ


You can customize Ellipsis with 👍 / 👎 feedback, review rules, user-specific overrides, quiet mode, and more.

Copy link

sonarcloud bot commented Oct 23, 2024

# for free to join this conversation on GitHub. Already have an account? # to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants