Repository navigation
Bump eclipse-temurin from 26-jre-alpine-3.24 to 27-jre-alpine-3.24 - #609
Conversation
dependabot
Bot
added
dependencies
✓ Safe, No Significant Changes DetectedThis PR updates dependencies, but no changes were found in the release notes or changelogs. Dependencies analyzed:
fossabot skipped detailed analysis because no significant changes were detected. |
|
|
|
|
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #609 +/- ##
===========================================
Coverage 100.00% 100.00%
Complexity 433 433
===========================================
Files 76 76
Lines 1386 1386
Branches 213 213
===========================================
Hits 1386 1386 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
No IssuesAll SAST findings were determined to be false positives, test code, or non-actionable. No real security issues require attention. fossabot analyzed this PR using SAST security analysis and AI (changed files only). |
Bumps eclipse-temurin from 26-jre-alpine-3.24 to 27-jre-alpine-3.24. --- updated-dependencies: - dependency-name: eclipse-temurin dependency-version: 27-jre-alpine-3.24 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
bcaabe0 to
1369455
Compare
|
|
✓ Safe, No IssuesThe scan of changed files identified 2 low-severity findings, both in the Dockerfile. No critical, high, or medium vulnerabilities were found. The issues relate to unpinned base image references, which is a supply chain hygiene concern rather than an actively exploitable vulnerability. Risk AssessmentLow risk overall. Both findings are the same class of issue: Dockerfile FROM instructions reference base images by tag (e.g., gradle:9.8.0-jdk26-alpine and eclipse-temurin:27-jre-alpine-3.24) rather than by immutable SHA256 digest. If an upstream image registry is compromised or a tag is silently overwritten with a malicious image, the build pipeline could inadvertently pull and use a tampered image — a classic supply chain attack vector. Exploitability is low in practice because it requires a registry-level compromise or tag mutation, but the impact could be significant if it does occur, as a poisoned base image could introduce backdoors or malicious code into the built artifact. This risk is elevated in automated CI/CD environments where builds run unattended. Recommendations
Findings2 issues across 1 file. Low/InfoShow 2 low/info findingsDockerfile:1 Dockerfile:85 fossabot analyzed this PR using SAST security analysis, impact analysis and AI (changed files only). |
![fossabot[bot]](https://avatars.githubusercontent.com/in/1421207?s=60&v=4){kind=small}
| ## | ||
|
|
||
| FROM eclipse-temurin:26-jre-alpine-3.24 AS production | ||
| FROM eclipse-temurin:27-jre-alpine-3.24 AS production |
There was a problem hiding this comment.
Security Finding: Low/Info
To ensure reproducible builds, pin Dockerfile FROM commands to a specific hash. You can find the hash by running docker pull eclipse-temurin and then specify it with eclipse-temurin:27-jre-alpine-3.24@sha256:<hash goes here>
Rule: dockerfile.audit.dockerfile-source-not-pinned
|
Bumps eclipse-temurin from 26-jre-alpine-3.24 to 27-jre-alpine-3.24.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)