[BUG] security vulnerabilities

[pharindoko]

Self Hosted
fider 21.1

Describe the bug
Found a lot of security vulnerabilities scanning the current stable image
https://trivy.dev/results/?image=getfider/fider:stable

To Reproduce
Steps to reproduce the behavior:

1. Go to 'https://trivy.dev/'
2. Click on 'Scan'

Expected behavior
Regular dependency updates for container images

[goenning]

Hey Florian, can you try running on getfider/fider:main?

This one is 2 months old, so it should report less vulnerabilities , but I'll build another image soon to catch the latest patches from upstream images

[goenning]

I tried re-scanning the image (getfider/fider:main), but it seems to be using a cached version. Do you know how to force a pull and re-scan it?

[pharindoko]

Hey @goenning

I guess your best option is to scan your local docker image using trivy.

[pharindoko]

Hey Florian, can you try running on getfider/fider:main?

This one is 2 months old, so it should report less vulnerabilities , but I'll build another image soon to catch the latest patches from upstream images

Yes the main versions has less critical issues found.
But I would like to use the last stable state.

[goenning]

Yeah, it's been a while since the last release, I'll get a new one released soon.

[asos-robbell]

Hi @goenning — any update on this? Bumping to the following will resolve all of the critical vulnerabilities:

FROM --platform=${TARGETPLATFORM:-linux/amd64} golang:1.19-bookworm AS server-builder 
...
FROM --platform=${TARGETPLATFORM:-linux/amd64} node:16-bookworm AS ui-builder 
...
FROM --platform=${TARGETPLATFORM:-linux/amd64} debian:bookworm-slim

Happy to raise a PR

[goenning]

Hey @asos-robbell I'd be happy to review and merge a PR. Thanks