Hacker News

points by akersten 1 day ago | 0 comments

> If you use our alpinelinux/gitlab container image, pull alpinelinux/gitlab:19.3.6 again. The image published on October 27 contains Ruby 3.3.13. Any 19.3.6 image you pulled before October 27, and all older tags, are vulnerable.

shouldn't they tag a new version instead of re-releasing a fixed 19.3.6, if earlier 19.3.6 are vulnerable?

[–] looperhacks 1 day ago

Image tags are not are versions and shouldn't be treated as such. The tag "19.3.6" refers to the version of Gitlab, which hasn't changed. This is why everyone should pin their images to a specific sha and setup a process to get notified on changes

[–] chrisweekly 20 hours ago

that's incredibly confusing. what's the point of the tag if the version is really the sha it happens to now point to? it only looks like semver?

[–] nullify88 1 day ago

Using Renovate can be one of those processes.