From 4c11259f55ccf5015e081148a3c9d5470ac862d4 Mon Sep 17 00:00:00 2001 From: CarlosFelipeOR Date: Thu, 16 Jul 2026 11:46:06 -0300 Subject: [PATCH 1/2] Fix Grype Scan: bump grype to v0.115.0 (v0.92.2 can't load current DB) Signed-off-by: CarlosFelipeOR (cherry picked from commit 3c8e750bb6e7a6a6e6bfaea68fe1ebd251acb078) (cherry picked from commit 4016b1999d3059175879ced0647001c662e90f54) Signed-off-by: CarlosFelipeOR (cherry picked from commit 1ebf3b171ac2165719ac57f195a15d21ceee46bf) --- .github/grype/run_grype_scan.sh | 2 +- .github/workflows/grype_scan.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/grype/run_grype_scan.sh b/.github/grype/run_grype_scan.sh index af428e37d669f..9cf99e9f9f9cb 100755 --- a/.github/grype/run_grype_scan.sh +++ b/.github/grype/run_grype_scan.sh @@ -3,7 +3,7 @@ set -e IMAGE=$1 -GRYPE_VERSION=${GRYPE_VERSION:-"v0.92.2"} +GRYPE_VERSION=${GRYPE_VERSION:-"v0.115.0"} docker pull $IMAGE docker pull anchore/grype:${GRYPE_VERSION} diff --git a/.github/workflows/grype_scan.yml b/.github/workflows/grype_scan.yml index 68c128e4e4707..5bb71c0e9b966 100644 --- a/.github/workflows/grype_scan.yml +++ b/.github/workflows/grype_scan.yml @@ -20,7 +20,7 @@ env: AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }} AWS_DEFAULT_REGION: ${{ secrets.AWS_DEFAULT_REGION }} AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }} - GRYPE_VERSION: "v0.92.2-arm64v8" + GRYPE_VERSION: "v0.115.0-arm64v8" jobs: grype_scan: From b25d2373969f24415d7e2a696bfdaa335cf19b0a Mon Sep 17 00:00:00 2001 From: Andrey Zvonov <32552679+zvonand@users.noreply.github.com> Date: Tue, 27 Oct 2026 23:07:43 +0100 Subject: [PATCH 2/2] Bump clickhouse-keeper base image to alpine:3.21.9 alpine:3.21.3 ships OpenSSL, zlib, musl and busybox versions with known High and Critical CVEs, which fails the keeper Grype scan. --- docker/keeper/Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docker/keeper/Dockerfile b/docker/keeper/Dockerfile index 0f04ee8db24c5..58163b59a906e 100644 --- a/docker/keeper/Dockerfile +++ b/docker/keeper/Dockerfile @@ -12,7 +12,7 @@ RUN arch=${TARGETARCH:-amd64} \ && ln -s "${rarch}-linux-gnu" /lib/linux-gnu -FROM alpine:3.21.3 +FROM alpine:3.21.9 ENV LANG=en_US.UTF-8 \ LANGUAGE=en_US:en \