Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Security updates for master release branch #4

Open
wants to merge 2 commits into
base: master
Choose a base branch
from

Conversation

jamescatto
Copy link
Collaborator

@jamescatto jamescatto commented Sep 27, 2022

Added changes suggested by PhilipJohnson: https://gist.github.com/phillipjohnson/290412e8c4291dcd23e320c981f96867

To create the image redash/redash with version 11.0.0:

$ docker build -t redash/redash:11.0.0 .

Then running grype on this gives these results

grype-11.0.0-only-fixed.txt

What type of PR is this?

  • Refactor
  • Feature
  • Bug Fix
  • New Query Runner (Data Source)
  • New Alert Destination
  • Other

Description

How is this tested?

  • Unit tests (pytest, jest)
  • E2E Tests (Cypress)
  • Manually
  • N/A

Related Tickets & Documents

Mobile & Desktop Screenshots/Recordings (if there are UI changes)

Copy link

@rjmunro rjmunro left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This looks much better, assuming it still all works :-).

# Ubuntu packages
RUN apt-get update && \
RUN apt-get update && apt-get upgrade -y && apt-get autoremove -y && \
Copy link

@rjmunro rjmunro Sep 27, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It shouldn't make any difference but I would move the autoremove after all the installs - put it last before the apt-get clean, then all the cleanup stuff is happening last and will clean everything it can.

@jamescatto jamescatto marked this pull request as ready for review September 27, 2022 15:57
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants