Skip to content

Comments

[Snyk] Security upgrade python from 3.8.5 to 3.13.4#14

Open
PavinStrickland wants to merge 1 commit intomasterfrom
snyk-fix-4510868ee6092f1ce1f5e4f88108210d
Open

[Snyk] Security upgrade python from 3.8.5 to 3.13.4#14
PavinStrickland wants to merge 1 commit intomasterfrom
snyk-fix-4510868ee6092f1ce1f5e4f88108210d

Conversation

@PavinStrickland
Copy link
Owner

snyk-top-banner

Snyk has created this PR to fix 3 vulnerabilities in the dockerfile dependencies of this project.

Keeping your Docker base image up-to-date means you’ll benefit from security fixes in the latest version of your chosen image.

Snyk changed the following file(s):

  • Dockerfile

We recommend upgrading to python:3.13.4, as this image has only 208 known vulnerabilities. To do this, merge this pull request, then verify your application still works as expected.

Vulnerabilities that will be fixed with an upgrade:

Issue Score
critical severity Out-of-bounds Write
SNYK-DEBIAN10-FREETYPE-1019582
  929  
critical severity Out-of-bounds Write
SNYK-DEBIAN10-FREETYPE-1019582
  929  
high severity Out-of-bounds Write
SNYK-DEBIAN10-LIBWEBP-5893093
  829  
high severity Out-of-bounds Write
SNYK-DEBIAN10-LIBWEBP-5893093
  829  
high severity CVE-2023-44487
SNYK-DEBIAN10-NGHTTP2-5953390
  829  

Important

  • Check the changes in this PR to ensure they won't cause issues with your project.
  • Max score is 1000. Note that the real score may have changed since the PR was raised.
  • This PR was automatically created by Snyk using the credentials of a real user.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic


Learn how to fix vulnerabilities with free interactive lessons:

🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.

@github-actions
Copy link

@PavinStrickland the signed-off-by was not found in the following 1 commits:

  • b8cd8f9: fix: Dockerfile to reduce vulnerabilities

📝 What should I do to fix it?

All proposed commits should include a sign-off in their messages, ideally at the end.

❔ Why it is required

The Developer Certificate of Origin (DCO) is a lightweight way for contributors to certify that they wrote or otherwise have the right to submit the code they are contributing to the project. Here is the full text of the DCO, reformatted for readability:

By making a contribution to this project, I certify that:

a. The contribution was created in whole or in part by me and I have the right to submit it under the open source license indicated in the file; or

b. The contribution is based upon previous work that, to the best of my knowledge, is covered under an appropriate open source license and I have the right under that license to submit that work with modifications, whether created in whole or in part by me, under the same open source license (unless I am permitted to submit under a different license), as indicated in the file; or

c. The contribution was provided directly to me by some other person who certified (a), (b) or (c) and I have not modified it.

d. I understand and agree that this project and the contribution are public and that a record of the contribution (including all personal information I submit with it, including my sign-off) is maintained indefinitely and may be redistributed consistent with this project or the open source license(s) involved.

Contributors sign-off that they adhere to these requirements by adding a Signed-off-by line to commit messages.

This is my commit message

Signed-off-by: Random Developer <randomdeveloper@example.com>

Git even has a -s command line option to append this automatically to your commit message:

$ git commit -s -m 'This is my commit message'

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants