Skip to content

Docker Package Updater - #820

Open
orto17 wants to merge 4 commits into
jfrog:devfrom
orto17:docker-package-updater
Open

Docker Package Updater#820
orto17 wants to merge 4 commits into
jfrog:devfrom
orto17:docker-package-updater

Conversation

@orto17

@orto17 orto17 commented Aug 2, 2026

Copy link
Copy Markdown
Contributor
  • The pull request is targeting the dev branch.
  • The code has been validated to compile successfully by running go vet ./....
  • The code has been formatted properly using go fmt ./....
  • All static analysis checks passed.
  • All tests have passed. If this feature is not already covered by the tests, new tests have been added.
  • Updated the Contributing page / ReadMe page / CI Workflow files if needed.
  • All changes are detailed at the description. if not already covered at JFrog Documentation, new documentation have been added.

Adds a DockerPackageUpdater that rewrites vulnerable base images in Dockerfiles.
Given a fix version from Xray, it locates each Dockerfile from the scan evidence, finds the matching FROM <image>:<version> line, and rewrites the tag or digest in place — preserving registry prefixes, AS <alias> stage names, --platform flags, and case-insensitive FROM keywords.

@orto17 orto17 added the safe to test Approve running integration tests on a pull request label Aug 2, 2026
@github-actions github-actions Bot removed the safe to test Approve running integration tests on a pull request label Aug 2, 2026
@orto17 orto17 added the safe to test Approve running integration tests on a pull request label Aug 2, 2026
@github-actions github-actions Bot removed the safe to test Approve running integration tests on a pull request label Aug 2, 2026
@attiasas attiasas added the improvement Automatically generated release notes label Aug 2, 2026
@attiasas
attiasas requested a review from a team August 2, 2026 07:42
@orto17 orto17 changed the title docker package updater Docker Package Updater Aug 2, 2026

@attiasas attiasas left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice work! checkout my comments

Comment thread remediation/sca/packageupdaters/dockerpackageupdater.go Outdated
Comment thread remediation/sca/packageupdaters/dockerpackageupdater.go
Comment thread remediation/sca/packageupdaters/dockerpackageupdater_test.go
@orto17
orto17 requested a review from attiasas August 2, 2026 10:00
@orto17 orto17 added the safe to test Approve running integration tests on a pull request label Aug 2, 2026
@github-actions github-actions Bot removed the safe to test Approve running integration tests on a pull request label Aug 2, 2026
@orto17 orto17 added the safe to test Approve running integration tests on a pull request label Aug 3, 2026
@github-actions github-actions Bot removed the safe to test Approve running integration tests on a pull request label Aug 3, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

improvement Automatically generated release notes

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants