CNB has no new version published. We need example of Rebase.

[msathe-tech]

gcr.io/buildpacks/builder:v1 for Java apps has 36 CVEs. There is no new version published. We also need a new version to check out the Rebase functionality.

[matthewrobertson]

We release updates to the base images very frequently. Could you please share the details of which CVEs you are finding in the images and how you are scanning? AR auto scanning turns up a few low severity CVEs but none of them have patches available so an update won't help.

[matthewrobertson]

I agree we need better documentation on how to rebase to update the base image layers.

We should also provide docs on how to remove unnecessary packages from the base image. This would allow users to eliminate CVEs that were introduced by packages that are not required by their application.

[jama22]

We just published an updated builder using Ubuntu 22 as the base image. This builder has substantially fewer CVEs, see https://github.com/GoogleCloudPlatform/buildpacks/discussions/271

I think the remaining work here might be to demonstrate how to execute a rebase.

[jama22]

@msathe-tech you can check out my demo of how to use rebase in my post here https://github.com/GoogleCloudPlatform/buildpacks/discussions/300

Feedback welcome!