Can you confirm that the latest renovate-ce image vulnerabilities are not reachable?

[celestegambardella]

Hello, the latest image version of renovate-ce:6.11.0-full has some security issues due to some of the packages installed.

My security team is asking whether these vulnerabilities are not reachable? In order to use the image.

If you could let me know that would be greatly appreciated!

[rarkins]

The full image will always have some vulnerabilities because it seems package managers always have some lingering vulnerabilities. We do not review these for reachability, our only recourse is to upgrade package managers periodically with most releases. We also do not offer this as a paid service, but perhaps your security team can employ some consultants to look into it.

If you use the non-full image then you'll see a lot less vulnerabilities, because there are a lot less package managers installed.

[celestegambardella]

Okay thank you so much for your response! Is there any downsides of using the non-full image?

[rarkins]

When you use the non-full image it means that languages and package managers need to be dynamically installed at runtime, so it may be a little slower at first

[celestegambardella]

Okay makes sense! Is there any documentation that I can find around what requirements and dependencies are then needed for renovate-ce to run Renovate or how you choose which dependences to pull down? I am unable to find any Renovate CE specific information around this or identify which third-party tools particularly need to be installed.

Thank you!