Skip to content

24.3.18: bump Grype to v0.115.0 to fix Grype scan - #2717

Merged
zvonand merged 3 commits into
releases/24.3.18from
blau/24.3.18-grype-bump
Oct 28, 2026
Merged

zvonand merged 3 commits into
releases/24.3.18from
blau/24.3.18-grype-bump

Conversation

@blau-ai

@blau-ai blau-ai commented Oct 27, 2026 •

Copy link
Copy Markdown
Collaborator

Cherry-pick of 1ebf3b1 onto releases/24.3.18, requested by @zvonand in #2701 (comment).

Grype v0.92.2 can't load the current vulnerability DB, so the Grype scan fails on the 24.3 line. This bumps the version to v0.115.0 in two places:

  • .github/workflows/grype_scan.yml: GRYPE_VERSION: "v0.115.0-arm64v8"
  • .github/grype/run_grype_scan.sh: default GRYPE_VERSION set to v0.115.0

The cherry-pick applied cleanly. Nothing else changed.

Changelog category (leave one):

  • CI Fix or Improvement (changelog entry is not required)

CI/CD Options

Exclude tests:

  • Fast test
  • Integration Tests
  • Stateless tests
  • Stateful tests
  • Unit tests
  • Performance tests
  • Aarch64 tests
  • All with ASAN
  • All with TSAN
  • All with MSAN
  • All with UBSAN
  • All with Coverage
  • All Regression
  • Disable CI Cache

Regression jobs to run:

  • Fast suites (mostly <1h)
  • Aggregate Functions (2h)
  • Alter (1.5h)
  • Benchmark (30m)
  • CAS (content-addressed storage; Antalya only)
  • ClickHouse Keeper (1h)
  • Iceberg (2h)
  • LDAP (1h)
  • OAuth (5m)
  • Parquet (1.5h)
  • RBAC (1.5h)
  • SSL Server (1h)
  • S3 (2h)
  • S3 Export (2h)
  • Swarms (30m)
  • Tiered Storage (2h)

🤖 Generated with Claude Code

Signed-off-by: CarlosFelipeOR <carlosfelipeor@gmail.com>
(cherry picked from commit 3c8e750)
(cherry picked from commit 4016b19)
Signed-off-by: CarlosFelipeOR <carlosfelipeor@gmail.com>
(cherry picked from commit 1ebf3b1)
@altinity-robot

altinity-robot commented Oct 27, 2026 •

Copy link
Copy Markdown
Collaborator

This is an automated comment for commit b25d237 with description of existing statuses. It's updated for the latest CI running

✅ Click here to open a full report in a separate page

Successful checks
Check nameDescriptionStatus
CI runningA meta-check that indicates the running CI. Normally, it's in success or pending state. The failed status indicates some problems with the PR✅ success
ClickHouse build checkBuilds ClickHouse in various configurations for use in further steps. You have to fix the builds that fail. Build logs often has enough information to fix the error, but you might have to reproduce the failure locally. The cmake options can be found in the build log, grepping for cmake. Use these options and follow the general build process✅ success
Compatibility checkChecks that clickhouse binary runs on distributions with old libc versions. If it fails, ask a maintainer for help✅ success
Docker keeper imageThe check to build and optionally push the mentioned image to docker hub✅ success
Docker server imageThe check to build and optionally push the mentioned image to docker hub✅ success
Install packagesChecks that the built packages are installable in a clear environment✅ success
Mergeable CheckChecks if all other necessary checks are successful✅ success
Ready for releaseThere's no description for the check yet, please add it to tests/ci/ci_config.py:CHECK_DESCRIPTIONS✅ success

alpine:3.21.3 ships OpenSSL, zlib, musl and busybox versions with known High and Critical CVEs, which fails the keeper Grype scan.
@zvonand
zvonand merged commit 0355104 into releases/24.3.18 Oct 28, 2026
65 checks passed
@zvonand zvonand added the verified Approved for release label Oct 28, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants