fix: container vulnerabilities

[pharindoko]

Hey,

I use codebuild for my runners and the default linux image (no custom image) provided.
Ecr has the capability to do a vulnerability scan (https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning.html).
I found a lot of critical security vulnerabilities inside of the container image.
Do you have a clue why ?

br,

flo

[kichik]

That's really weird. We run apt upgrade on every image build. Which vulnerabilities is it complaining about?

[pharindoko]

for example:

Name
parse-url

Installed version / Fixed version
/ Not available

Package manager
NPM

File path
home/runner/externals/node12/lib/node_modules/npm/docs/package-lock.json

most of the errors seem to be related to this externals/node12 directory...

[kichik]

That's part of https://github.com/actions/runner. I'm not sure we can do more than open a ticket for them to update it.

[pharindoko]

yes figured out the same. There`s already an issue open ... actions/runner#2145

[kichik]

I'm surprised it has so little upvotes.

[pharindoko]

same opinion - but would have expected that gh keeps it more up to date....
we talk about 16 critical and 123 high vulnerabilities that the ecr image scan found ...

[kichik]

Maybe this will be resolved once Node 12 is completely removed. It's already deprecated. https://github.blog/changelog/2022-09-22-github-actions-all-actions-will-begin-running-on-node16-instead-of-node12/