Semgrep: Semgrep in docker always reports "new version is available"

Created on 21 Dec 2020  路  2Comments  路  Source: returntocorp/semgrep

Describe the bug
Semgrep when run in docker under the :latest tag prints out:

$ docker run -v "${PWD}:/src" returntocorp/semgrep --config=go-config2.yml test/golang
 A new version of Semgrep is available. Please see https://github.com/returntocorp/semgrep#upgrading for more information.

To Reproduce
As described in https://notes.eatonphil.com/static-analysis-with-semgrep.html

Expected behavior
Semgrep should realize the docker tag is latest or develop and not print that there is a new version.

What is the priority of the bug to you?
P2

bug docker low

All 2 comments

I suspect this is because your latest tag is out of date. Note that docker run does not try to pull latest. E.g.

$ docker run returntocorp/semgrep --version
0.24.0
$ echo 'print(5 == 5)' | docker run -i returntocorp/semgrep --pattern '$X == $X' --lang python -
A new version of Semgrep is available. Please see https://github.com/returntocorp/semgrep#upgrading for more information.
/tmp/tmpz19einpg
1:print(5 == 5)
ran 1 rules on 1 files: 1 findings
$ docker pull returntocorp/semgrep:latest
latest: Pulling from returntocorp/semgrep
...
Digest: sha256:203eefa7fef3d85e9313fd322642a78ee030188876122a0e7521fdc5c4d199c3
Status: Downloaded newer image for returntocorp/semgrep:latest
docker.io/returntocorp/semgrep:latest
$ docker run returntocorp/semgrep --version
0.35.0
$ echo 'print(5 == 5)' | docker run -i returntocorp/semgrep --pattern '$X == $X' --lang python -
/tmp/tmpeop0cv5_
1:print(5 == 5)
ran 1 rules on 1 files: 1 findings

So, if you're running via Docker, the message is correctly telling you to visit https://github.com/returntocorp/semgrep#upgrading, which suggests running docker pull returntocorp/semgrep:latest.

Closing this out, let me know if the above description wasn't the issue.

Was this page helpful?
0 / 5 - 0 ratings