Add release v2.8.8

CHANGELOG.md

@@ -1,3 +1,7 @@
+## Release 2.8.8
+
+The alpine base image used by `weave-kube` and `weave-npc` has been upgraded to version 3.20.0 in this release. This removes several CVEs.
+
 ## Release 2.8.7
 
 This release has upgraded dependencies based on CVE recommendations.

reweave/CHANGELOG.md

@@ -2,6 +2,17 @@
 
 All changes made to the weave net codebase during the reweave effort will be documented in this file.
 
+## 2.8.8
+
+* Changed version in `reweave/Makefile` to 2.8.8
+* Modified reweave and main CHANGELOG.md
+
+## 2.8.8-beta1
+
+### Changed
+
+* Alpine base image upgraded to alpine:3.20.0 in `reweave/Makefile`
+
 ## 2.8.7
 
 ### Changed

reweave/Makefile

@@ -1,7 +1,7 @@
-IMAGE_VERSION ?= 2.8.7
+IMAGE_VERSION ?= 2.8.8
 REGISTRY_USER ?= rajchaudhuri
 
-ALPINE_BASEIMAGE ?= alpine:3.19.1
+ALPINE_BASEIMAGE ?= alpine:3.20.0
 
 # Targets
 .PHONY: build-images

reweave/scans/badge.json

@@ -1 +1 @@
-{"schemaVersion": 1, "label": "Vulnerabilty count", "message": "18", "color": "orange"}
+{"schemaVersion": 1, "label": "Vulnerabilty count", "message": "3", "color": "orange"}

reweave/scans/report.md

@@ -1,115 +1,61 @@
 # Vulnerability Report
 
 ```
-Report date: 2024-05-05
+Report date: 2024-06-19
-Unique vulnerability count: 18
+Unique vulnerability count: 3
-Images version: 2.8.7
+Images version: 2.8.8
 ```
 
 ## Scanner Details
 
 ```
 Application:         grype
-Version:             0.77.2
+Version:             0.79.1
-BuildDate:           2024-05-01T16:20:45Z
+BuildDate:           2024-06-17T19:33:32Z
-GitCommit:           bd16101ad0ed30c38e95d0992d0ad53f709dc5df
+GitCommit:           239741f535c59d6e1b9faee61f64ebcf4361d2c5
-GitDescription:      v0.77.2
+GitDescription:      v0.79.1
 Platform:            linux/amd64
-GoVersion:           go1.21.9
+GoVersion:           go1.22.4
 Compiler:            gc
-Syft Version:        v1.3.0
+Syft Version:        v1.7.0
 Supported DB Schema: 5
 ```
 
 ## Vulnerabilities
 
-### weave-kube: (18) 
+### weave-kube: (3) 
 
 ```
-NAME           INSTALLED   FIXED-IN  TYPE  VULNERABILITY   SEVERITY 
+NAME    INSTALLED  FIXED-IN  TYPE       VULNERABILITY   SEVERITY 
-busybox        1.36.1-r15            apk   CVE-2023-42366  Medium    
+stdlib  go1.21.9             go-module  CVE-2024-24790  Critical  
-busybox        1.36.1-r15            apk   CVE-2023-42365  Medium    
+stdlib  go1.21.9             go-module  CVE-2024-24789  Medium    
-busybox        1.36.1-r15            apk   CVE-2023-42364  Medium    
+stdlib  go1.21.9             go-module  CVE-2024-24787  Unknown
-busybox        1.36.1-r15            apk   CVE-2023-42363  Medium    
-busybox-binsh  1.36.1-r15            apk   CVE-2023-42366  Medium    
-busybox-binsh  1.36.1-r15            apk   CVE-2023-42365  Medium    
-busybox-binsh  1.36.1-r15            apk   CVE-2023-42364  Medium    
-busybox-binsh  1.36.1-r15            apk   CVE-2023-42363  Medium    
-curl           8.5.0-r0              apk   CVE-2024-0853   Medium    
-curl           8.5.0-r0              apk   CVE-2024-2466   Unknown   
-curl           8.5.0-r0              apk   CVE-2024-2398   Unknown   
-curl           8.5.0-r0              apk   CVE-2024-2004   Unknown   
-libuv          1.47.0-r0             apk   CVE-2024-24806  High      
-nghttp2-libs   1.58.0-r0             apk   CVE-2024-28182  Medium    
-ssl_client     1.36.1-r15            apk   CVE-2023-42366  Medium    
-ssl_client     1.36.1-r15            apk   CVE-2023-42365  Medium    
-ssl_client     1.36.1-r15            apk   CVE-2023-42364  Medium    
-ssl_client     1.36.1-r15            apk   CVE-2023-42363  Medium
 ```
 
-### weave-npc: (12) 
+### weave-npc: (3) 
 
 ```
-NAME           INSTALLED   FIXED-IN  TYPE  VULNERABILITY   SEVERITY 
+NAME    INSTALLED  FIXED-IN  TYPE       VULNERABILITY   SEVERITY 
-busybox        1.36.1-r15            apk   CVE-2023-42366  Medium    
+stdlib  go1.21.9             go-module  CVE-2024-24790  Critical  
-busybox        1.36.1-r15            apk   CVE-2023-42365  Medium    
+stdlib  go1.21.9             go-module  CVE-2024-24789  Medium    
-busybox        1.36.1-r15            apk   CVE-2023-42364  Medium    
+stdlib  go1.21.9             go-module  CVE-2024-24787  Unknown
-busybox        1.36.1-r15            apk   CVE-2023-42363  Medium    
-busybox-binsh  1.36.1-r15            apk   CVE-2023-42366  Medium    
-busybox-binsh  1.36.1-r15            apk   CVE-2023-42365  Medium    
-busybox-binsh  1.36.1-r15            apk   CVE-2023-42364  Medium    
-busybox-binsh  1.36.1-r15            apk   CVE-2023-42363  Medium    
-ssl_client     1.36.1-r15            apk   CVE-2023-42366  Medium    
-ssl_client     1.36.1-r15            apk   CVE-2023-42365  Medium    
-ssl_client     1.36.1-r15            apk   CVE-2023-42364  Medium    
-ssl_client     1.36.1-r15            apk   CVE-2023-42363  Medium
 ```
 
-### weave: (18) 
+### weave: (3) 
 
 ```
-NAME           INSTALLED   FIXED-IN  TYPE  VULNERABILITY   SEVERITY 
+NAME    INSTALLED  FIXED-IN  TYPE       VULNERABILITY   SEVERITY 
-busybox        1.36.1-r15            apk   CVE-2023-42366  Medium    
+stdlib  go1.21.9             go-module  CVE-2024-24790  Critical  
-busybox        1.36.1-r15            apk   CVE-2023-42365  Medium    
+stdlib  go1.21.9             go-module  CVE-2024-24789  Medium    
-busybox        1.36.1-r15            apk   CVE-2023-42364  Medium    
+stdlib  go1.21.9             go-module  CVE-2024-24787  Unknown
-busybox        1.36.1-r15            apk   CVE-2023-42363  Medium    
-busybox-binsh  1.36.1-r15            apk   CVE-2023-42366  Medium    
-busybox-binsh  1.36.1-r15            apk   CVE-2023-42365  Medium    
-busybox-binsh  1.36.1-r15            apk   CVE-2023-42364  Medium    
-busybox-binsh  1.36.1-r15            apk   CVE-2023-42363  Medium    
-curl           8.5.0-r0              apk   CVE-2024-0853   Medium    
-curl           8.5.0-r0              apk   CVE-2024-2466   Unknown   
-curl           8.5.0-r0              apk   CVE-2024-2398   Unknown   
-curl           8.5.0-r0              apk   CVE-2024-2004   Unknown   
-libuv          1.47.0-r0             apk   CVE-2024-24806  High      
-nghttp2-libs   1.58.0-r0             apk   CVE-2024-28182  Medium    
-ssl_client     1.36.1-r15            apk   CVE-2023-42366  Medium    
-ssl_client     1.36.1-r15            apk   CVE-2023-42365  Medium    
-ssl_client     1.36.1-r15            apk   CVE-2023-42364  Medium    
-ssl_client     1.36.1-r15            apk   CVE-2023-42363  Medium
 ```
 
-### weaveexec: (18) 
+### weaveexec: (3) 
 
 ```
-NAME           INSTALLED   FIXED-IN  TYPE  VULNERABILITY   SEVERITY 
+NAME    INSTALLED  FIXED-IN  TYPE       VULNERABILITY   SEVERITY 
-busybox        1.36.1-r15            apk   CVE-2023-42366  Medium    
+stdlib  go1.21.9             go-module  CVE-2024-24790  Critical  
-busybox        1.36.1-r15            apk   CVE-2023-42365  Medium    
+stdlib  go1.21.9             go-module  CVE-2024-24789  Medium    
-busybox        1.36.1-r15            apk   CVE-2023-42364  Medium    
+stdlib  go1.21.9             go-module  CVE-2024-24787  Unknown
-busybox        1.36.1-r15            apk   CVE-2023-42363  Medium    
-busybox-binsh  1.36.1-r15            apk   CVE-2023-42366  Medium    
-busybox-binsh  1.36.1-r15            apk   CVE-2023-42365  Medium    
-busybox-binsh  1.36.1-r15            apk   CVE-2023-42364  Medium    
-busybox-binsh  1.36.1-r15            apk   CVE-2023-42363  Medium    
-curl           8.5.0-r0              apk   CVE-2024-0853   Medium    
-curl           8.5.0-r0              apk   CVE-2024-2466   Unknown   
-curl           8.5.0-r0              apk   CVE-2024-2398   Unknown   
-curl           8.5.0-r0              apk   CVE-2024-2004   Unknown   
-libuv          1.47.0-r0             apk   CVE-2024-24806  High      
-nghttp2-libs   1.58.0-r0             apk   CVE-2024-28182  Medium    
-ssl_client     1.36.1-r15            apk   CVE-2023-42366  Medium    
-ssl_client     1.36.1-r15            apk   CVE-2023-42365  Medium    
-ssl_client     1.36.1-r15            apk   CVE-2023-42364  Medium    
-ssl_client     1.36.1-r15            apk   CVE-2023-42363  Medium
 ```