Hi Flagger maintainers,
We've been scanning the ghcr.io/fluxcd/flagger container image and our tooling has flagged the following CVEs against the current release:
We don't yet have full details on which specific dependencies or base image layers are responsible for each CVE, but wanted to raise them here in case the maintainers have visibility or are already tracking them.
Questions:
- Are any of these CVEs already on your radar?
- Are there plans for a patch release in the near term to address them?
- Is there anything we can do in the meantime (e.g. a base image rebuild, specific dependency upgrade) to remediate while waiting for an upstream release?
For context, we noticed the upstream release cadence has slowed to roughly one release every 3–6 months, so we want to understand whether a fix will land soon or whether we need to consider a local patching strategy.
Thanks for maintaining Flagger — we appreciate the project!
Hi Flagger maintainers,
We've been scanning the
ghcr.io/fluxcd/flaggercontainer image and our tooling has flagged the following CVEs against the current release:We don't yet have full details on which specific dependencies or base image layers are responsible for each CVE, but wanted to raise them here in case the maintainers have visibility or are already tracking them.
Questions:
For context, we noticed the upstream release cadence has slowed to roughly one release every 3–6 months, so we want to understand whether a fix will land soon or whether we need to consider a local patching strategy.
Thanks for maintaining Flagger — we appreciate the project!