[Snyk] Security upgrade ubuntu from noble-20250925 to noble-20260113 by kevin-benton · Pull Request #288 · stjudecloud/workflows

kevin-benton · 2026-01-17T09:41:33Z

Snyk has created this PR to fix 2 vulnerabilities in the dockerfile dependencies of this project.

Keeping your Docker base image up-to-date means you’ll benefit from security fixes in the latest version of your chosen image.

Snyk changed the following file(s):

docker/util/Dockerfile

We recommend upgrading to ubuntu:24.04, as this image has only 8 known vulnerabilities. To do this, merge this pull request, then verify your application still works as expected.

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Out-of-bounds Write SNYK-UBUNTU2404-GNUPG2-14849555	281
	Directory Traversal SNYK-UBUNTU2404-PAM-11936905	231
	Directory Traversal SNYK-UBUNTU2404-PAM-11936905	231
	Directory Traversal SNYK-UBUNTU2404-PAM-11936905	231
	Directory Traversal SNYK-UBUNTU2404-PAM-11936905	231

Important

Check the changes in this PR to ensure they won't cause issues with your project.
Max score is 1000. Note that the real score may have changed since the PR was raised.
This PR was automatically created by Snyk using the credentials of a real user.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Out-of-bounds Write
🦉 Directory Traversal

kevin-benton · 2026-01-17T09:41:52Z

This is an update from a development build (noble-20250925) to the stable Long-Term Support (LTS) release of Ubuntu 24.04. This process primarily involves stabilization, security patches, and bug fixes to transition from a pre-release to a production-ready state. No breaking changes are expected as it is within the same "Noble Numbat" release series.

Source: Ubuntu release documentation

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

adthrasher · 2026-01-21T17:14:07Z

The corresponding package.json needs to have the version updated. All references to the image also need to be bumped to the new version.

Completes Snyk PR #288 which upgraded the util Dockerfile base image from `ubuntu:noble-20250925` to `ubuntu:24.04` (fixes CVE-2024-53055 and CVE-2024-53924). The Dockerfile change alone would fail CI validation - container version tags must match package.json and all WDL workflow references must use the current version. ## Changes - Bumped `docker/util/package.json` version: `3.0.1` → `3.0.2` - Updated 16 container references across 9 WDL files to use `ghcr.io/stjudecloud/util:3.0.2` ## Affected Files **Config:** - `docker/util/package.json` **Workflows using util container:** - `data_structures/flag_filter.wdl` - `data_structures/read_group.wdl` (3 references) - `tools/htseq.wdl` - `tools/md5sum.wdl` - `tools/util.wdl` (7 references) - `workflows/dnaseq/dnaseq-standard.wdl` - `workflows/qc/quality-check-standard.wdl` - `workflows/rnaseq/rnaseq-standard.wdl` Before submitting this PR, please make sure: - [x] You have added a few sentences describing the PR here. - [x] The code passes all CI tests without any errors or warnings. - [x] You have added tests (when appropriate). - [x] You have added an entry in any relevant CHANGELOGs (when appropriate). - [x] If you have made any changes to the `scripts/` or `docker/` directories, please ensure any image versions have been incremented accordingly! - [x] You have updated the README or other documentation to account for these changes (when appropriate).   <details> <summary>Original prompt</summary> > Pull Request: #288 </details>  --- 💬 We'd love your input! Share your thoughts on Copilot coding agent in our [2 minute survey](https://gh.io/copilot-coding-agent-survey). --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: adthrasher <1165729+adthrasher@users.noreply.github.com>

github-advanced-security

Snyk Container found more than 20 potential problems in the proposed changes. Check the Files changed tab for more details.

docker/util/Dockerfile

Completes Snyk PR #288 which upgraded the util Dockerfile base image from `ubuntu:noble-20250925` to `ubuntu:24.04` (fixes CVE-2024-53055 and CVE-2024-53924). The Dockerfile change alone would fail CI validation - container version tags must match package.json and all WDL workflow references must use the current version. ## Changes - Bumped `docker/util/package.json` version: `3.0.1` → `3.0.2` - Updated 16 container references across 9 WDL files to use `ghcr.io/stjudecloud/util:3.0.2` ## Affected Files **Config:** - `docker/util/package.json` **Workflows using util container:** - `data_structures/flag_filter.wdl` - `data_structures/read_group.wdl` (3 references) - `tools/htseq.wdl` - `tools/md5sum.wdl` - `tools/util.wdl` (7 references) - `workflows/dnaseq/dnaseq-standard.wdl` - `workflows/qc/quality-check-standard.wdl` - `workflows/rnaseq/rnaseq-standard.wdl` Before submitting this PR, please make sure: - [x] You have added a few sentences describing the PR here. - [x] The code passes all CI tests without any errors or warnings. - [x] You have added tests (when appropriate). - [x] You have added an entry in any relevant CHANGELOGs (when appropriate). - [x] If you have made any changes to the `scripts/` or `docker/` directories, please ensure any image versions have been incremented accordingly! - [x] You have updated the README or other documentation to account for these changes (when appropriate).   <details> <summary>Original prompt</summary> > Pull Request: #288 </details>  --- 💬 We'd love your input! Share your thoughts on Copilot coding agent in our [2 minute survey](https://gh.io/copilot-coding-agent-survey). --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: adthrasher <1165729+adthrasher@users.noreply.github.com>

The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-UBUNTU2404-GNUPG2-14849555 - https://snyk.io/vuln/SNYK-UBUNTU2404-PAM-11936905 - https://snyk.io/vuln/SNYK-UBUNTU2404-PAM-11936905 - https://snyk.io/vuln/SNYK-UBUNTU2404-PAM-11936905 - https://snyk.io/vuln/SNYK-UBUNTU2404-PAM-11936905

Completes Snyk PR #288 which upgraded the util Dockerfile base image from `ubuntu:noble-20250925` to `ubuntu:24.04` (fixes CVE-2024-53055 and CVE-2024-53924). The Dockerfile change alone would fail CI validation - container version tags must match package.json and all WDL workflow references must use the current version. ## Changes - Bumped `docker/util/package.json` version: `3.0.1` → `3.0.2` - Updated 16 container references across 9 WDL files to use `ghcr.io/stjudecloud/util:3.0.2` ## Affected Files **Config:** - `docker/util/package.json` **Workflows using util container:** - `data_structures/flag_filter.wdl` - `data_structures/read_group.wdl` (3 references) - `tools/htseq.wdl` - `tools/md5sum.wdl` - `tools/util.wdl` (7 references) - `workflows/dnaseq/dnaseq-standard.wdl` - `workflows/qc/quality-check-standard.wdl` - `workflows/rnaseq/rnaseq-standard.wdl` Before submitting this PR, please make sure: - [x] You have added a few sentences describing the PR here. - [x] The code passes all CI tests without any errors or warnings. - [x] You have added tests (when appropriate). - [x] You have added an entry in any relevant CHANGELOGs (when appropriate). - [x] If you have made any changes to the `scripts/` or `docker/` directories, please ensure any image versions have been incremented accordingly! - [x] You have updated the README or other documentation to account for these changes (when appropriate).   <details> <summary>Original prompt</summary> > Pull Request: #288 </details>  --- 💬 We'd love your input! Share your thoughts on Copilot coding agent in our [2 minute survey](https://gh.io/copilot-coding-agent-survey). --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: adthrasher <1165729+adthrasher@users.noreply.github.com>

) ![snyk-top-banner](https://res.cloudinary.com/snyk/image/upload/r-d/scm-platform/snyk-pull-requests/pr-banner-default.svg) ### Snyk has created this PR to fix 4 vulnerabilities in the dockerfile dependencies of this project. Keeping your Docker base image up-to-date means you’ll benefit from security fixes in the latest version of your chosen image. #### Snyk changed the following file(s): - `docker/umap/Dockerfile` We recommend upgrading to `python:3.14.2-alpine`, as this image has only **0** known vulnerabilities. To do this, merge this pull request, then verify your application still works as expected. #### Vulnerabilities that will be fixed with an upgrade: | | Issue | Score | :-------------------------:|:-------------------------|:------------------------- ![critical severity](https://res.cloudinary.com/snyk/image/upload/w_20,h_20/v1561977819/icon/c.png 'critical severity') | Integer Overflow or Wraparound [SNYK-ALPINE321-SQLITE-12675067](https://snyk.io/vuln/SNYK-ALPINE321-SQLITE-12675067) |   **264**   ![critical severity](https://res.cloudinary.com/snyk/image/upload/w_20,h_20/v1561977819/icon/c.png 'critical severity') | CVE-2025-6965 [SNYK-ALPINE321-SQLITE-11191065](https://snyk.io/vuln/SNYK-ALPINE321-SQLITE-11191065) |   **263**   ![high severity](https://res.cloudinary.com/snyk/image/upload/w_20,h_20/v1561977819/icon/h.png 'high severity') | Integer Overflow or Wraparound [SNYK-ALPINE321-SQLITE-9712340](https://snyk.io/vuln/SNYK-ALPINE321-SQLITE-9712340) |   **161**   ![high severity](https://res.cloudinary.com/snyk/image/upload/w_20,h_20/v1561977819/icon/h.png 'high severity') | CVE-2025-26519 [SNYK-ALPINE321-MUSL-8720634](https://snyk.io/vuln/SNYK-ALPINE321-MUSL-8720634) |   **139**   ![high severity](https://res.cloudinary.com/snyk/image/upload/w_20,h_20/v1561977819/icon/h.png 'high severity') | CVE-2025-26519 [SNYK-ALPINE321-MUSL-8720634](https://snyk.io/vuln/SNYK-ALPINE321-MUSL-8720634) |   **139**   --- > [!IMPORTANT] > > - Check the changes in this PR to ensure they won't cause issues with your project. > - Max score is 1000. Note that the real score may have changed since the PR was raised. > - This PR was automatically created by Snyk using the credentials of a real user. --- **Note:** _You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs._ For more information: <img src="https://api.segment.io/v1/pixel/track?data=eyJ3cml0ZUtleSI6InJyWmxZcEdHY2RyTHZsb0lYd0dUcVg4WkFRTnNCOUEwIiwiYW5vbnltb3VzSWQiOiI3MDM0YTRmNy1hMWZkLTRlZjktYjFjZi02ZTg1YjFhYmNhNGYiLCJldmVudCI6IlBSIHZpZXdlZCIsInByb3BlcnRpZXMiOnsicHJJZCI6IjcwMzRhNGY3LWExZmQtNGVmOS1iMWNmLTZlODViMWFiY2E0ZiJ9fQ==" width="0" height="0"/> 🧐 [View latest project report](https://app.snyk.io/org/compbio/project/cf7a5123-a2ee-4ad5-9857-a70917b24925?utm_source=github&utm_medium=referral&page=fix-pr) 📜 [Customise PR templates](https://docs.snyk.io/scan-using-snyk/pull-requests/snyk-fix-pull-or-merge-requests/customize-pr-templates?utm_source=github&utm_content=fix-pr-template) 🛠 [Adjust project settings](https://app.snyk.io/org/compbio/project/cf7a5123-a2ee-4ad5-9857-a70917b24925?utm_source=github&utm_medium=referral&page=fix-pr/settings) 📚 [Read about Snyk's upgrade logic](https://docs.snyk.io/scan-with-snyk/snyk-open-source/manage-vulnerabilities/upgrade-package-versions-to-fix-vulnerabilities?utm_source=github&utm_content=fix-pr-template) --- **Learn how to fix vulnerabilities with free interactive lessons:** 🦉 [Integer Overflow or Wraparound](https://learn.snyk.io/lesson/integer-overflow-or-wraparound/?loc=fix-pr) [//]: # 'snyk:metadata:{"breakingChangeRiskLevel":null,"FF_showPullRequestBreakingChanges":false,"FF_showPullRequestBreakingChangesWebSearch":false,"customTemplate":{"variablesUsed":[],"fieldsUsed":[]},"dependencies":[{"name":"python","from":"3.13.1-alpine","to":"3.14.2-alpine"}],"env":"prod","issuesToFix":["SNYK-ALPINE321-SQLITE-12675067","SNYK-ALPINE321-SQLITE-11191065","SNYK-ALPINE321-SQLITE-9712340","SNYK-ALPINE321-MUSL-8720634","SNYK-ALPINE321-MUSL-8720634"],"prId":"7034a4f7-a1fd-4ef9-b1cf-6e85b1abca4f","prPublicId":"7034a4f7-a1fd-4ef9-b1cf-6e85b1abca4f","packageManager":"dockerfile","priorityScoreList":[264,263,161,139],"projectPublicId":"cf7a5123-a2ee-4ad5-9857-a70917b24925","projectUrl":"https://app.snyk.io/org/compbio/project/cf7a5123-a2ee-4ad5-9857-a70917b24925?utm_source=github&utm_medium=referral&page=fix-pr","prType":"fix","templateFieldSources":{"branchName":"default","commitMessage":"default","description":"default","title":"default"},"templateVariants":["updated-fix-title","priorityScore"],"type":"auto","upgrade":["SNYK-ALPINE321-MUSL-8720634","SNYK-ALPINE321-MUSL-8720634","SNYK-ALPINE321-SQLITE-11191065","SNYK-ALPINE321-SQLITE-12675067","SNYK-ALPINE321-SQLITE-9712340"],"vulns":["SNYK-ALPINE321-SQLITE-12675067","SNYK-ALPINE321-SQLITE-11191065","SNYK-ALPINE321-SQLITE-9712340","SNYK-ALPINE321-MUSL-8720634"],"patch":[],"isBreakingChange":false,"remediationStrategy":"vuln"}' --------- Co-authored-by: snyk-bot <snyk-bot@snyk.io> Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com> Co-authored-by: adthrasher <1165729+adthrasher@users.noreply.github.com> Co-authored-by: Andrew Thrasher <adthrasher@gmail.com>

Copilot AI mentioned this pull request Jan 21, 2026

Bump util Docker image version for Ubuntu 24.04 base upgrade #289

Merged

6 tasks

github-advanced-security bot found potential problems Jan 21, 2026

View reviewed changes

adthrasher reviewed Feb 6, 2026

View reviewed changes

docker/util/Dockerfile Outdated Show resolved Hide resolved

adthrasher changed the title ~~[Snyk] Security upgrade ubuntu from noble-20250925 to 24.04~~ [Snyk] Security upgrade ubuntu from noble-20250925 to noble-20260113 Feb 6, 2026

adthrasher force-pushed the snyk-fix-29f47df8693f754e3a31c4fb20799183 branch from b72473a to 0359c2e Compare February 6, 2026 16:56

adthrasher requested a review from a-frantz February 6, 2026 21:06

snyk-bot and others added 6 commits February 6, 2026 16:15

Use date stamped image

d154d43

chore: bump python-plotting

cfa95bd

chore: bump umap version

5084fd1

adthrasher force-pushed the snyk-fix-29f47df8693f754e3a31c4fb20799183 branch from f0a2425 to 5084fd1 Compare February 6, 2026 21:15

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Snyk] Security upgrade ubuntu from noble-20250925 to noble-20260113#288

[Snyk] Security upgrade ubuntu from noble-20250925 to noble-20260113#288
kevin-benton wants to merge 6 commits intomainfrom
snyk-fix-29f47df8693f754e3a31c4fb20799183

kevin-benton commented Jan 17, 2026

Uh oh!

kevin-benton commented Jan 17, 2026

Uh oh!

adthrasher commented Jan 21, 2026

Uh oh!

github-advanced-security bot left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

kevin-benton commented Jan 17, 2026

Snyk has created this PR to fix 2 vulnerabilities in the dockerfile dependencies of this project.

Snyk changed the following file(s):

Vulnerabilities that will be fixed with an upgrade:

Uh oh!

kevin-benton commented Jan 17, 2026

Uh oh!

adthrasher commented Jan 21, 2026

Uh oh!

github-advanced-security bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants