mysticalsoap/docker
Watch
1
0
Fork
You've already forked docker
 0
Code Issues 35 Pull requests 6 Wiki Activity Actions

docs: how to check a Renovate candidate against an image-scan finding #389

Merged
mysticalsoap merged 1 commit from docs/image-scan-candidate-check into trunk 2026-10-07 19:55:31 -04:00
Conversation 0 Commits 1 Files changed 1 +1 -1
mysticalsoap commented 2026-10-07 19:54:11 -04:00
Owner
Copy link

Problem

The image-scan paragraph says a finding is closed by a newer digest and to check Renovate, but an open PR can still carry the finding (Lidarr #357 does: same ASP.NET runtime), and there was no written way to get the CVE list behind a count.

Fix

One sentence: scan the candidate with trivy in dagu-scanner before merging, and scan a running image by id for the CVE list.

Verification

Docs only; both commands are what produced the 2026-10-07 triage (three candidates clean, Lidarr not).

🤖 Generated with Claude Code

## Problem The image-scan paragraph says a finding is closed by a newer digest and to check Renovate, but an open PR can still carry the finding (Lidarr #357 does: same ASP.NET runtime), and there was no written way to get the CVE list behind a count. ## Fix One sentence: scan the candidate with trivy in dagu-scanner before merging, and scan a running image by id for the CVE list. ## Verification Docs only; both commands are what produced the 2026-10-07 triage (three candidates clean, Lidarr not). 🤖 Generated with [Claude Code](https://claude.com/claude-code)
docs: how to check a Renovate candidate against an image-scan finding
All checks were successful
validate / validate (pull_request) Successful in 23s
Details
56e24721b2
 
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
mysticalsoap deleted branch docs/image-scan-candidate-check 2026-10-07 19:55:31 -04:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
audit-work
Security enhancements coming out of an audit of the stack

  
bug
Something is broken

  
docs
Wiki, in-repo docs, comments

  
general-admin
Learning, refinement, and housekeeping

  
major-upgrade
Major-version bump, review carefully

  
needs-vps-sync

   
new-service
Adding a new service to the stack

  
on-hold
Deliberately parked, not ready to start

  
outside-work
Not part of the stack itself, tracked here anyway

  
post-podman
Suited to after the Podman migration

  
renovate
Opened by renovate-bot

  
upstream
Needs an issue or PR on someone else's project

  
vps
Work on the VPS rather than the homelab

No labels
audit-work
bug
docs
general-admin
major-upgrade
needs-vps-sync
new-service
on-hold
outside-work
post-podman
renovate
upstream
vps
Milestone
Clear milestone
No items
No milestone
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
mysticalsoap/docker!389
No description provided.