chore(deps): bump bellsoft/liberica-openjre-alpine from 17.0.12 to 23-38 in /docker-jans-link

[dependabot]

Bumps bellsoft/liberica-openjre-alpine from 17.0.12 to 23-38.

Most Recent Ignore Conditions Applied to This Pull Request

Dependency Name	Ignore Conditions
bellsoft/liberica-openjre-alpine	[>= 21.pre.37.a, < 22]
bellsoft/liberica-openjre-alpine	[>= 20.pre.37.a, < 21]
bellsoft/liberica-openjre-alpine	[>= 19.pre.37.a, < 20]
bellsoft/liberica-openjre-alpine	[>= 18.pre.37.a, < 19]

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dryrunsecurity]

DryRun Security Summary

The provided code changes update the Dockerfile for the "docker-jans-link" component, including upgrading the base image, Jetty version, Jython version, and the version of the "jans-link-server" component, with a focus on improving application security by addressing potential vulnerabilities in the underlying runtime and dependencies.

Expand for full summary

Summary:

The provided code changes are related to the Dockerfile for the "docker-jans-link" component. The key changes include updating the base image to a newer version of the BellSoft Liberica OpenJRE Alpine distribution, upgrading the Jetty version, updating the Jython version, and updating the version of the "jans-link-server" component.

From an application security perspective, these changes are generally positive as they help address potential security vulnerabilities in the underlying runtime and dependencies. However, it's essential to ensure that the new base image and updated dependencies are also secure and properly maintained. Additionally, the Dockerfile includes various environment variables related to configuration management and secrets management, which require proper handling and secure storage to maintain the overall security of the application. Logging and monitoring, as well as the use of a non-root user, are also important security considerations that have been addressed in the Dockerfile changes.

Files Changed:

• docker-jans-link/Dockerfile: The changes in this Dockerfile include:
  • Updating the base image from "bellsoft/liberica-openjre-alpine:17.0.12" to "bellsoft/liberica-openjre-alpine:23-38".
  • Upgrading the Jetty version from 11.0.20 to the latest version.
  • Updating the Jython version to 2.7.3 with a build date of 2022-08-01.
  • Updating the version of the "jans-link-server" component to "1.1.6-SNAPSHOT" with a build date of "2024-09-16 06:52".
  • Setting up directories for Jetty logs and Prometheus configuration.
  • Creating a non-root "jetty" user to run the application.

Code Analysis

We ran 9 analyzers against 1 file and 1 analyzer had findings. 8 analyzers had no findings.

Analyzer	Findings
Sensitive Files Analyzer	1 finding

Riskiness

🟢 Risk threshold not exceeded.

View PR in the DryRun Dashboard.

[iromli]

The suggested version is incompatible.

@dependabot ignore this major version

[dependabot]

OK, I won't notify you about version 23-38.x.x again, unless you re-open this PR.