Skip to content

[Snyk] Security upgrade grafana/grafana from latest to 12.3.0-18578466485 #48

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Giftedx wants to merge 1 commit into
base: main
Choose a base branch
from
Open

[Snyk] Security upgrade grafana/grafana from latest to 12.3.0-18578466485 #48

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion grafana/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
# Use official Grafana image as base
FROM grafana/grafana:latest
FROM grafana/grafana:12.3.0-18578466485
Copy link
Contributor

@gemini-code-assist gemini-code-assist bot Oct 18, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

While pinning the base image to a specific version is the correct approach to fix vulnerabilities and ensure build reproducibility, the tag 12.3.0-18578466485 appears to be a non-standard, possibly unstable, build-specific tag. Using such tags can introduce risks if they are not official, stable releases. For long-term maintainability, it's preferable to use official semantic version tags (e.g., 12.3.0) or image digests. If a stable version with the required security patches is not yet available, consider adding a comment here explaining why this specific tag is necessary.


# Switch to root to install additional dependencies
USER root
Expand Down
Loading