This message was deleted.

don't use 1.21. It's EOL since Jun 2022.

Yeah that is an ancient version. We address vulns by releasing new versions with updated packages. You are never going to get something 2+ years old to pass a vuln scan. It has 2+ year old vulns.

@creamy-pencil-82913 At the time Iron Bank only had this particular version of RKE2. Since then there are newer versions available but these newer versions still have critical and high findings. Thanks for the reference to the chat. I'll try to reach out to them

Don’t forget, Iron Bank was just supposed to be a reciprocity easy button. It’s not mandated. And from your example, almost everyone is just vetting and approving their own containers at this point.