Skip to content

Upgrade to Alpine Linux 3.18, Node 20, Go 1.20, PHP 8.1 and Ruby 3.2

Oscar Tovar requested to merge otovar/update-to-go-1.20 into master

What does this MR do?

As part of the security reaction rotation, I'm opening this MR to update the base image for the gemnasium and sbomgen-golang images. In addition, this updates the Go runtime to version 1.20 from 1.17 and 1.18. This does two things:

  1. It bumps the versions so that they use a maintained version
  2. It adds a new feature that helps the implementation of !538 (merged). Specifically, for efficiency purposes, the MR requires the ability to use the -json flag when running go list. This feature is only available in Go 1.19 and newer.

Lastly, I've removed the pinning on previous versions of Ruby and PHP that were no longer compatible with the newer versions of Alpine. This should improve our security posture, and get us the latest improvements and security fixes as well.

What are the relevant issue numbers?

N/A

Does this MR meet the acceptance criteria?

Edited by Oscar Tovar

Merge request reports