[Snyk] Security upgrade alpine from 3.16 to 3.21.3

[cruizen]

Snyk has created this PR to fix 1 vulnerabilities in the dockerfile dependencies of this project.

Keeping your Docker base image up-to-date means you’ll benefit from security fixes in the latest version of your chosen image.

Snyk changed the following file(s):

• hostplumber/Dockerfile

We recommend upgrading to alpine:3.21.3, as this image has only 0 known vulnerabilities. To do this, merge this pull request, then verify your application still works as expected.

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Out-of-bounds Write SNYK-ALPINE316-BUSYBOX-6913410	514
	Out-of-bounds Write SNYK-ALPINE316-BUSYBOX-6913410	514

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.

Summary by Bito

Security update to Alpine base image from 3.16 to 3.21.3 to address a critical Out-of-bounds Write vulnerability in busybox (SNYK-ALPINE316-BUSYBOX-6913410). The update improves the application's security posture with the vulnerability having a severity score of 514/1000.

Unit tests added: False

Estimated effort to review (1-5, lower is better): 1

[bito-code-review]

Code Review Agent Run #08b56e

Actionable Suggestions - 1

• hostplumber/Dockerfile - 1

  • Consider using digest SHA for base image · Line 24-24

Review Details

• Files reviewed - 1 · Commit Range: 7987e8b..7987e8b

  • hostplumber/Dockerfile
• Files skipped - 0
• Tools

  • Golangci-lint (Linter) - ✔︎ Successful
  • Whispers (Secret Scanner) - ✔︎ Successful
  • Detect-secrets (Secret Scanner) - ✔︎ Successful

---

AI Code Review powered by

[bito-code-review]

Changelist by Bito

This pull request implements the following key changes.

Key Change	Files Impacted
Bug Fix - Security Vulnerability Fix in Base Image	- Dockerfile - Upgraded Alpine base image from 3.16 to 3.21.3 to address busybox security vulnerability

[bito-code-review]

Consider using digest SHA for base image

Consider using a more specific version tag for the base image. While alpine:3.21.3 is more specific than alpine:3.16, it might be worth considering pinning to a digest SHA for better reproducibility. For example: alpine:3.21.3@sha256:<digest>.

Code suggestion

Check the AI-generated fix before applying

Suggested change

	FROM alpine:3.21.3
	FROM alpine:3.21.3@sha256:e3773cb32acf3d77d4fdb9b3a0e8e5665c721232ea3d9f0f0a6ca77cc8ef4f38

Code Review Run #08b56e

---

Should Bito avoid suggestions like this for future reviews? (Manage Rules)

• Yes, avoid them