MongoDB upgrade

[mtcolman]

Question

Hi, apologies if this should have been a bug report or feature request.

As per the issue I've raised here: litmuschaos/test-tools#336,

The image litmuschaos/mongo:4.2.8 is being used in litmus 3.0.0 (e.g. here: https://github.com/litmuschaos/litmus/blob/master/mkdocs/docs/3.0.0-beta4/litmus-3.0.0-beta4.yaml#L823), it is very old (2 years) and comes from (I believe) here.

It has a lot of vulnerabilities:

litmuschaos/mongo:4.2.8 (ubuntu 18.04)

Total: 374 (UNKNOWN: 0, LOW: 144, MEDIUM: 215, HIGH: 15, CRITICAL: 0)

It uses upstream mongo:4.2.8 and the latest version (11 days old) is mongo:6.0.4.

What I'd like to know is how the upgrade should be performed/correlated given it is cross-repo and if there is a reason why such an old image is still in use etc? And how can we go about getting this resolved?

Thanks!

[imrajdas]

Hi @mtcolman , we will take this mongo upgrade in LitmusChaos 3.0. Thanks for reminding this.

[Chan9390]

The base image of litmuschaos/mongo is Ubuntu 18.04 which has attained End of Standard Support and will not receive security updates.

[mtcolman]

FYI -

• mongo:4.2.8 = ubuntu 18.04
• mongo:6.0.8 = ubuntu 22.04

[ksatchit]

Mongo has been upgraded as part of 3.0 GA: litmuschaos/test-tools@8b624a7