Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update spilo image to resolve some vulnerabilities #965

Closed
nanory opened this issue Jan 19, 2024 · 4 comments
Closed

Update spilo image to resolve some vulnerabilities #965

nanory opened this issue Jan 19, 2024 · 4 comments

Comments

@nanory
Copy link

nanory commented Jan 19, 2024

The last official release of the spilo image is already more than 10 months old:
https://github.com/zalando/spilo/releases/tag/3.0-p1

Are there any plans to update the spilo image in order to reduce some of the vulnerabilities that are caused by the installed packages and their age?

@nanory
Copy link
Author

nanory commented Jan 19, 2024

The following comment might be the reason why it hasn't been updated for a while:
#939 (comment)

@klehelley
Copy link

There has actually been a 3.1-p1 release that is more recent and fixes a lot of vulnerabilities, however it is not shown on the releases page (see #960).

It is true however that it would be better to have more frequent releases of the image. Seeing how they are built, even based on the same commit that would be enough to expose and distribute fixes for the applications and tools that are included in the image.

@OlleLarsson
Copy link
Contributor

OlleLarsson commented Feb 16, 2024

To save people who are using the postgres-operator from some headaches, do not run 3.1-p1 with the latest released version of the operator. In that image, the patroni version, introduced changes which makes failover iffy.

@hughcapet
Copy link
Member

ghcr.io/zalando/spilo-15:3.2-p1 is available (along with ghcr.io/zalando/spilo-16:3.2-p2)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

4 participants