Skip to content

Commit 0434be5

Browse files
mathieu-benoitmathieu-benoit
authored
Bump container base images to fix CVEs (GoogleCloudPlatform#3160)
* cartservice - update to .NET 10 Signed-off-by: Mathieu Benoit <mathieu-benoit@hotmail.fr> * .NET 10 in CI Signed-off-by: Mathieu Benoit <mathieu-benoit@hotmail.fr> * net10.0 for tests too Signed-off-by: Mathieu Benoit <mathieu-benoit@hotmail.fr> * checkoutservice - Golang 1.23 --> 1.25 Signed-off-by: Mathieu Benoit <mathieu-benoit@hotmail.fr> * checkoutservice - go get -t -u ./... * checkoutservice - -ldflags="-s -w" * frontend - golang 1.23 --> 1.25 + no debug info * toolchain go1.25.4 * checkoutservice - go get -u all * go mod tidy * productcatalog - golang 1.25 * productcatalog - go get -u all & go mod tidy * shipping - golang 1.25 * Fix crontend unit tests * Fix frontend/validator unit tests * go1.25 * adservice - Update to latest 21 * adservice - back to final image in Java 25 * adservice - back to JRE for final image * Golang - gcr.io/distroless/static * currencyservice - Node 20.19 and Algine 3.22 * paymentservice - Node 20.19 and Algine 3.22 * recommendationservice - python:3.12.12 * emailservice - python:3.12.12 * loadgenerator - python:3.12.12 --------- Signed-off-by: Mathieu Benoit <mathieu-benoit@hotmail.fr>
1 parent 18f3b73 commit 0434be5

File tree

30 files changed

+696
-847
lines changed

30 files changed

+696
-847
lines changed

‎.github/workflows/ci-main.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@ jobs:
3636
env:
3737
DOTNET_INSTALL_DIR: "./.dotnet"
3838
with:
39-
dotnet-version: '9.0'
39+
dotnet-version: '10.0'
4040
- uses: actions/setup-go@v6
4141
with:
4242
go-version: '1.25'

‎.github/workflows/ci-pr.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,7 @@ jobs:
4040
env:
4141
DOTNET_INSTALL_DIR: "./.dotnet"
4242
with:
43-
dotnet-version: '9.0'
43+
dotnet-version: '10.0'
4444
- uses: actions/setup-go@v6
4545
with:
4646
go-version: '1.25'

‎.github/workflows/install-dependencies.sh‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -30,16 +30,16 @@ sudo chown root:root /etc/apt/sources.list.d/microsoft-prod.list
3030

3131
sudo apt-get install -y apt-transport-https && \
3232
sudo apt-get update && \
33-
sudo apt-get install -y dotnet-sdk-8.0
33+
sudo apt-get install -y dotnet-sdk-10.0
3434
echo "✅ dotnet installed"
3535

3636
# install kubectl
3737
sudo apt-get install -yqq kubectl git
3838
echo "✅ kubectl installed"
3939

4040
# install go
41-
wget https://golang.org/dl/go1.19.linux-amd64.tar.gz
42-
sudo tar -C /usr/local -xzf go1.19.linux-amd64.tar.gz
41+
wget https://golang.org/dl/go1.25.linux-amd64.tar.gz
42+
sudo tar -C /usr/local -xzf go1.25.linux-amd64.tar.gz
4343
echo 'export GOPATH=$HOME/go' >> ~/.profile
4444
echo 'export PATH=$PATH:/usr/local/go/bin:$GOPATH/bin' >> ~/.profile
4545
source ~/.profile

‎src/adservice/Dockerfile‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212
# See the License for the specific language governing permissions and
1313
# limitations under the License.
1414

15-
FROM --platform=$BUILDPLATFORM eclipse-temurin:21.0.5_11-jdk@sha256:a20cfa6afdbf57ff2c4de77ae2d0e3725a6349f1936b5ad7c3d1b06f6d1b840a AS builder
15+
FROM --platform=$BUILDPLATFORM eclipse-temurin:21.0.9_10-jdk-noble@sha256:e2ba4c84f2356d829837f561e171482f5121d75e537e8fe04e91fb4381694641 AS builder
1616

1717
WORKDIR /app
1818

@@ -25,7 +25,7 @@ COPY . .
2525
RUN chmod +x gradlew
2626
RUN ./gradlew installDist
2727

28-
FROM eclipse-temurin:25-jre-alpine@sha256:bf9c91071c4f90afebb31d735f111735975d6fe2b668a82339f8204202203621
28+
FROM eclipse-temurin:25.0.1_8-jre-alpine@sha256:b51543f89580c1ba70e441cfbc0cfc1635c3c16d2e2d77fec9d890342a3a8687
2929

3030
# @TODO: https://github.com/GoogleCloudPlatform/microservices-demo/issues/2517
3131
# Download Stackdriver Profiler Java agent

‎src/adservice/build.gradle‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -20,8 +20,8 @@ def jacksonDatabindVersion = "2.20.1"
2020
def protocVersion = "4.33.1"
2121

2222
tasks.withType(JavaCompile) {
23-
sourceCompatibility = JavaVersion.VERSION_19
24-
targetCompatibility = JavaVersion.VERSION_19
23+
sourceCompatibility = JavaVersion.VERSION_21
24+
targetCompatibility = JavaVersion.VERSION_21
2525
}
2626

2727
ext {

‎src/cartservice/src/Dockerfile‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@
1313
# limitations under the License.
1414

1515
# https://mcr.microsoft.com/product/dotnet/sdk
16-
FROM --platform=$BUILDPLATFORM mcr.microsoft.com/dotnet/sdk:9.0.101-noble@sha256:1f13e67d295e02abdfd187c341f887442bad611eda536766172ced401fc8b9fa AS builder
16+
FROM --platform=$BUILDPLATFORM mcr.microsoft.com/dotnet/sdk:10.0.100-noble@sha256:c7445f141c04f1a6b454181bd098dcfa606c61ba0bd213d0a702489e5bd4cd71 AS builder
1717
ARG TARGETARCH
1818
WORKDIR /app
1919
COPY cartservice.csproj .
@@ -30,7 +30,7 @@ RUN dotnet publish cartservice.csproj \
3030
-o /cartservice
3131

3232
# https://mcr.microsoft.com/product/dotnet/runtime-deps
33-
FROM mcr.microsoft.com/dotnet/runtime-deps:9.0.1-noble-chiseled@sha256:6f7466eda39e24efaf7eab2325e15d776a685d13cc93b4ea0cde9ee4f7982210
33+
FROM mcr.microsoft.com/dotnet/runtime-deps:10.0.0-noble-chiseled@sha256:b857c8cb8d929183cfe4c6dd9994abba92a2639dd2dbaf06005379f815991604
3434

3535
WORKDIR /app
3636
COPY --from=builder /cartservice .

‎src/cartservice/src/cartservice.csproj‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,15 @@
11
<Project Sdk="Microsoft.NET.Sdk.Web">
22

33
<PropertyGroup>
4-
<TargetFramework>net9.0</TargetFramework>
4+
<TargetFramework>net10.0</TargetFramework>
55
</PropertyGroup>
66

77
<ItemGroup>
88
<PackageReference Include="Grpc.AspNetCore" Version="2.71.0" />
99
<PackageReference Include="Grpc.HealthCheck" Version="2.71.0" />
10-
<PackageReference Include="Microsoft.Extensions.Caching.StackExchangeRedis" Version="9.0.11" />
11-
<PackageReference Include="Google.Cloud.Spanner.Data" Version="5.6.0" />
12-
<PackageReference Include="Npgsql" Version="9.0.4" />
10+
<PackageReference Include="Microsoft.Extensions.Caching.StackExchangeRedis" Version="10.0.0" />
11+
<PackageReference Include="Google.Cloud.Spanner.Data" Version="5.7.0" />
12+
<PackageReference Include="Npgsql" Version="10.0.0" />
1313
<PackageReference Include="Google.Cloud.SecretManager.V1" Version="2.7.0" />
1414
</ItemGroup>
1515

‎src/cartservice/tests/cartservice.tests.csproj‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,14 @@
11
<Project Sdk="Microsoft.NET.Sdk">
22

33
<PropertyGroup>
4-
<TargetFramework>net9.0</TargetFramework>
4+
<TargetFramework>net10.0</TargetFramework>
55

66
<IsPackable>false</IsPackable>
77
</PropertyGroup>
88

99
<ItemGroup>
1010
<PackageReference Include="Grpc.Net.Client" Version="2.71.0" />
11-
<PackageReference Include="Microsoft.AspNetCore.TestHost" Version="9.0.11" />
11+
<PackageReference Include="Microsoft.AspNetCore.TestHost" Version="10.0.0" />
1212
<PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.0.1" />
1313
<PackageReference Include="xunit" Version="2.9.3" />
1414
<PackageReference Include="xunit.runner.visualstudio" Version="3.1.5" />

‎src/checkoutservice/Dockerfile‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212
# See the License for the specific language governing permissions and
1313
# limitations under the License.
1414

15-
FROM --platform=$BUILDPLATFORM golang:1.23.4-alpine@sha256:c23339199a08b0e12032856908589a6d41a0dab141b8b3b21f156fc571a3f1d3 AS builder
15+
FROM --platform=$BUILDPLATFORM golang:1.25.4-alpine@sha256:d3f0cf7723f3429e3f9ed846243970b20a2de7bae6a5b66fc5914e228d831bbb AS builder
1616
ARG TARGETOS
1717
ARG TARGETARCH
1818
WORKDIR /src
@@ -25,9 +25,9 @@ COPY . .
2525

2626
# Skaffold passes in debug-oriented compiler flags
2727
ARG SKAFFOLD_GO_GCFLAGS
28-
RUN GOOS=${TARGETOS} GOARCH=${TARGETARCH} CGO_ENABLED=0 go build -gcflags="${SKAFFOLD_GO_GCFLAGS}" -o /checkoutservice .
28+
RUN GOOS=${TARGETOS} GOARCH=${TARGETARCH} CGO_ENABLED=0 go build -ldflags="-s -w" -gcflags="${SKAFFOLD_GO_GCFLAGS}" -o /checkoutservice .
2929

30-
FROM scratch
30+
FROM gcr.io/distroless/static
3131

3232
WORKDIR /src
3333
COPY --from=builder /checkoutservice /src/checkoutservice

‎src/checkoutservice/go.mod‎

Lines changed: 37 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -1,49 +1,49 @@
11
module github.com/GoogleCloudPlatform/microservices-demo/src/checkoutservice
22

3-
go 1.23.0
3+
go 1.25
4+
5+
toolchain go1.25.4
46

57
require (
6-
cloud.google.com/go/profiler v0.4.2
8+
cloud.google.com/go/profiler v0.4.3
79
github.com/google/uuid v1.6.0
810
github.com/pkg/errors v0.9.1
911
github.com/sirupsen/logrus v1.9.3
10-
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.60.0
11-
go.opentelemetry.io/otel v1.35.0
12-
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.35.0
13-
go.opentelemetry.io/otel/sdk v1.35.0
14-
google.golang.org/grpc v1.71.0
15-
google.golang.org/protobuf v1.36.6
12+
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.63.0
13+
go.opentelemetry.io/otel v1.38.0
14+
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.38.0
15+
go.opentelemetry.io/otel/sdk v1.38.0
16+
google.golang.org/grpc v1.77.0
17+
google.golang.org/protobuf v1.36.10
1618
)
1719

1820
require (
19-
cloud.google.com/go v0.116.0 // indirect
20-
cloud.google.com/go/auth v0.11.0 // indirect
21-
cloud.google.com/go/auth/oauth2adapt v0.2.6 // indirect
22-
cloud.google.com/go/compute/metadata v0.6.0 // indirect
23-
github.com/cenkalti/backoff/v4 v4.3.0 // indirect
24-
github.com/go-logr/logr v1.4.2 // indirect
21+
cloud.google.com/go v0.123.0 // indirect
22+
cloud.google.com/go/auth v0.17.0 // indirect
23+
cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect
24+
cloud.google.com/go/compute/metadata v0.9.0 // indirect
25+
github.com/cenkalti/backoff/v5 v5.0.3 // indirect
26+
github.com/go-logr/logr v1.4.3 // indirect
2527
github.com/go-logr/stdr v1.2.2 // indirect
26-
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
27-
github.com/google/pprof v0.0.0-20240903155634-a8630aee4ab9 // indirect
28-
github.com/google/s2a-go v0.1.8 // indirect
29-
github.com/googleapis/enterprise-certificate-proxy v0.3.4 // indirect
30-
github.com/googleapis/gax-go/v2 v2.14.0 // indirect
31-
github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.1 // indirect
32-
go.opencensus.io v0.24.0 // indirect
33-
go.opentelemetry.io/auto/sdk v1.1.0 // indirect
34-
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.35.0 // indirect
35-
go.opentelemetry.io/otel/metric v1.35.0 // indirect
36-
go.opentelemetry.io/otel/trace v1.35.0 // indirect
37-
go.opentelemetry.io/proto/otlp v1.5.0 // indirect
38-
golang.org/x/crypto v0.36.0 // indirect
39-
golang.org/x/net v0.38.0 // indirect
40-
golang.org/x/oauth2 v0.27.0 // indirect
41-
golang.org/x/sync v0.12.0 // indirect
42-
golang.org/x/sys v0.31.0 // indirect
43-
golang.org/x/text v0.23.0 // indirect
44-
golang.org/x/time v0.8.0 // indirect
45-
google.golang.org/api v0.210.0 // indirect
46-
google.golang.org/genproto v0.0.0-20241118233622-e639e219e697 // indirect
47-
google.golang.org/genproto/googleapis/api v0.0.0-20250218202821-56aae31c358a // indirect
48-
google.golang.org/genproto/googleapis/rpc v0.0.0-20250218202821-56aae31c358a // indirect
28+
github.com/google/pprof v0.0.0-20251114195745-4902fdda35c8 // indirect
29+
github.com/google/s2a-go v0.1.9 // indirect
30+
github.com/googleapis/enterprise-certificate-proxy v0.3.7 // indirect
31+
github.com/googleapis/gax-go/v2 v2.15.0 // indirect
32+
github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.3 // indirect
33+
go.opentelemetry.io/auto/sdk v1.2.1 // indirect
34+
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.38.0 // indirect
35+
go.opentelemetry.io/otel/metric v1.38.0 // indirect
36+
go.opentelemetry.io/otel/trace v1.38.0 // indirect
37+
go.opentelemetry.io/proto/otlp v1.9.0 // indirect
38+
golang.org/x/crypto v0.45.0 // indirect
39+
golang.org/x/net v0.47.0 // indirect
40+
golang.org/x/oauth2 v0.33.0 // indirect
41+
golang.org/x/sync v0.18.0 // indirect
42+
golang.org/x/sys v0.38.0 // indirect
43+
golang.org/x/text v0.31.0 // indirect
44+
golang.org/x/time v0.14.0 // indirect
45+
google.golang.org/api v0.256.0 // indirect
46+
google.golang.org/genproto v0.0.0-20251124214823-79d6a2a48846 // indirect
47+
google.golang.org/genproto/googleapis/api v0.0.0-20251124214823-79d6a2a48846 // indirect
48+
google.golang.org/genproto/googleapis/rpc v0.0.0-20251124214823-79d6a2a48846 // indirect
4949
)

0 commit comments

Comments
 (0)