Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Outdated Dependencies Causing Security Vulnerabilities #1145

Open
Footur opened this issue Aug 22, 2023 · 5 comments
Open

Outdated Dependencies Causing Security Vulnerabilities #1145

Footur opened this issue Aug 22, 2023 · 5 comments

Comments

@Footur
Copy link

Footur commented Aug 22, 2023

The project's dependencies are outdated and potentially exposing us to security vulnerabilities. Many of Fider's dependencies have released new versions with security patches, but we have not updated them in a while. This not only poses a security risk but also hinders our ability to leverage new features and improvements.

Proposed Solution:

Utilize the Renovate bot to automate dependency updates. Renovate is a powerful tool that can automatically detect and update outdated dependencies in this project, ensuring that we are always using the latest, most secure versions. It can also create pull requests with detailed changelogs and test the updates to ensure they do not introduce breaking changes. By implementing Renovate, we can proactively address dependency-related issues and maintain a more secure and up-to-date codebase.
@Goldenflamer
Copy link

Goldenflamer commented Oct 29, 2023 •
edited
Loading

Would be an acceptable way to keep our Fider docker images updated, by just doing apt-get update && apt-get upgrade?

I know it's not the correct way, as the service could be programmed to work with a specific dependency version. But, after trying it on my homelab, no functionalities were broken, and also de base image was updated.

Thanks!

No, this is not a valid option. You only get the OS updates with apt upgrade. But tons of Node packages would need updates too to keep the software secure.

@mattwoberts
Copy link
Contributor

We've got dependabot running, does renovate offer much more than dependabot?

@Footur
Copy link
Author

Footur commented Sep 5, 2024

We've got dependabot running, does renovate offer much more than dependabot?

Yes, it can update Dockerfiles and Helm Charts either.

@kimtiago
Copy link
Contributor

kimtiago commented Oct 21, 2024 •
edited
Loading

Hi @mattwoberts ,

I want to use Fider at our company, but there are a lot of vulnerabilities caused by outdated dependencies. I noticed that many were fixed by commits 168b66e and 934ee5e, but there are still several remaining. I think it's because docker image... How about update Debian from "Bullseye" to "Bookworm"?

Below, I’ve included a report generated today:

fider-main.txt

@mattwoberts
Copy link
Contributor

@kimtiago You're right, the docker image is well due for an update, feel free to PR, otherwise I can take a look soon-ish

@kimtiago kimtiago mentioned this issue Oct 24, 2024
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
4 participants
@mattwoberts @Footur @Goldenflamer @kimtiago