I saw that the `ssh-run` bitbucket pipeline still relies on `alpine:3.9` container image.
As far as i could find the security updates for that release were stopped on 01 Jan 2021
I suspect that this old release includes many security issues which were fixed in newer versions of alpine linux.
This should definitely be fixed as this container has access to private keys used to deploy software to production systems.
@Stephan Eicher hi. Thanks for your investigation.
We will update the ssh-run pipe docker image and notify you.
Regards, Igor
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.
The following pipelines are also affected:
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.
@Stephan Eicher hi. According to this page:
python 3.10 EOL will be 2026-10, so no changes needed.
But we will update alpine image in your listed in the comments pipes.
We have more than 50 pipes to maintain, so, unfortunately, our strategy usually when no new features to be implemented is to wait for users feature request.
You could always ask us in the community to bump a pipe version or even create a pull-request by yourself since it is open-sourced.
Also keep in mind that pipes are not the same as pipelines.
Pipes provide a simple way to configure a pipeline. They are especially powerful when you want to work with third-party tools. More details here.
Regards, Igor
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.