fix: upgrade snyk-docker-plugin and snyk-policy #5587
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
cmars
approved these changes
Nov 19, 2024
There was a problem hiding this comment.
LGTM.
I reviewed the dependency changes brought in by this:
- snyk/snyk-docker-plugin@v6.13.2...v6.13.2-hotfix
- snyk/policy@v4.0.0...v4.1.4
- snyk/module@v3.0.0...v3.3.0
Did not see any obviously breaking changes. Looks like we're either fixing stuff that was just broken, or addressing false positives.
Assuming the ignored dependencies in .snyk are transitive vulns brought in by these dependencies?
In any case LGTM.
The ignored vuln is a new one published in the last 7 days, so whilst we have triaged it with an ignore on main branch the vuln is "unhandled" on release-candidate branch. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Pull Request Submission Checklist
What does this PR do?
A hot fix release to address 3 bugs affecting 1.1294.0
snyk container test|monitor– Unable to process RedHat images when the “content_sets” attribute was missing in the redhat-content-manifests file. (fix: redhat-content-manifests content sets parsing UNIFY-387 snyk-docker-plugin#615)snyk container monitor– Some customers have reported encountering a "too many vulnerable paths for conversion to legacy test output" error when scanning Python projects (fix: optional python dependencies snyk-docker-plugin#614)snyk container test|monitorandsnyk test|monitor– "Invalid JSON" is produced occurs under the following conditions (picked from: fix: policy library logging messages to stdout instead of stderr #5583)Note: The
snyk-docker-pluginis being installed from a GitHub tag as there are changes on +6.13.2 which can not be released until December.