build(deps): bump alpine from 3.20.2 to 3.20.3 #701
Conversation
![dependabot[bot]](https://avatars.githubusercontent.com/in/29110?s=60&v=4){kind=small}
Bumps alpine from 3.20.2 to 3.20.3. --- updated-dependencies: - dependency-name: alpine dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]>
dependabot
bot
added
dependencies
|
This pull request has been automatically marked as stale because it has not had activity in the last 30 days. It will be closed in 7 days if no further activity occurs. Please feel free to give a status update now, ping for review, or re-open when it's ready. Thank you for your contributions! |
|
@dependabot rebase |
|
Sorry, only users with push access can use that command. |
|
@mattklein123 I saw that you merged the last alpine upgrade. would you be able to have a look at this one too? this will resolve https://nvd.nist.gov/vuln/detail/CVE-2024-6119 in openssl as per grafana/loki#14140 |
|
hi @mattklein123 - do you see any issues merging this change? |
|
Hi, bumping this - would be great if we could get this merged as the vulnerability is affecting us downstream 🙏🏽 |
|
Hi @zirain - I saw that you were a recent committer in this repo. Would you be able to have a look? |
|
@rayseaward I'm sorry, I didn't have auth to merged this. |
|
hi @mattklein123 @ysawa0 - wondering if either of you would be able to merge this change? there's a cve in the current alpine library (in openssl CVE-2024-6119) that this would resolve. thanks! |
Bumps alpine from 3.20.2 to 3.20.3.
You can trigger a rebase of this PR by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)