Skip to content

Conversation

jranabahu
Copy link
Contributor

Summary

This PR addresses the CVEs raised in #342.

Changes include,

  • Update golang.org/x/crypto v0.35.0 // indirect
  • golang.org/x/net v0.36.0 // indirect
  • golang.org/x/oauth2 v0.18.0 // indirect
  • golang.org/x/sync v0.11.0 // indirect
  • golang.org/x/sys v0.30.0 // indirect

Note that the go version has been changed from 1.21 to 1.23 because golang.org/x/[email protected] requires go >= 1.23.0; switching to go1.23.8.

Scan output

process-exporter ±|master|→ docker build -t process-exporter:v0.8.5-cves-fixed .
process-exporter ±|master|→ trivy image process-exporter:v0.8.5-cves-fixed
2025-04-02T12:43:17+01:00       INFO    [vuln] Vulnerability scanning is enabled
2025-04-02T12:43:17+01:00       INFO    [secret] Secret scanning is enabled
2025-04-02T12:43:17+01:00       INFO    [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-04-02T12:43:17+01:00       INFO    [secret] Please see also https://trivy.dev/v0.61/docs/scanner/secret#recommendation for faster secret detection
2025-04-02T12:43:17+01:00       INFO    Number of language-specific files       num=1
2025-04-02T12:43:17+01:00       INFO    [gobinary] Detecting vulnerabilities...

Report Summary

┌──────────────────────┬──────────┬─────────────────┬─────────┐
│        Target        │   Type   │ Vulnerabilities │ Secrets │
├──────────────────────┼──────────┼─────────────────┼─────────┤
│ bin/process-exporter │ gobinary │        0        │    -    │
└──────────────────────┴──────────┴─────────────────┴─────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)

@jranabahu
Copy link
Contributor Author

@ncabatoff can you please let me know whether you are happy with these changes?

@ncabatoff ncabatoff merged commit a18132b into ncabatoff:master Apr 21, 2025
1 check passed
@ncabatoff
Copy link
Owner

Thanks @jranabahu !

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants