Re: [eclipse.org-committers] Guidance following the Trivy security incid

[Heiko Rupp <hrupp@xxxxxxxxxx>]

I think tl;dr don’t use „docker run some/image:latest“, but
pin that on a (trusted) version with some/image:1.2.3 as
concrete version.
Likewise for libraries. Things like dependabot can be a big
help, but have it automatically install latest & greatest
is prone for attacks like the litellm one (that got triggered
via trivy apparently).

On 24 Mar 2026, at 14:05, Edward Willink via eclipse.org-committers wrote:

> Hi
>
> This guidance would appear to be very important, yet I understand very little of it. I have no idea what a GitHub Action is, let alone how to pin it.