Skip to content

Fix Python dependency vulnerabilities #301

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
zeevmoney merged 3 commits into from
Mar 18, 2026
Merged

Fix Python dependency vulnerabilities #301

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
8f5e721
Bump vulnerable Python dependencies and remove wheel from image
zeevmoney Mar 14, 2026
3d4f4e4
Bump Rust base image to 1.88 to fix cargo-chef MSRV
zeevmoney Mar 14, 2026
de6fad0
Merge branch 'main' into per-14185/fix-dep-vulnerabilities
zeevmoney Mar 18, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,7 @@ ARG OPA_BUILD=permit
# couldn't get this to work without the help of those two sources
# (1) this stage will be run always on current arch
# zigbuild & Cargo targets added

FROM --platform=$BUILDPLATFORM rust:1.94-alpine AS rust_chef
WORKDIR /app
ENV PKGCONFIG_SYSROOTDIR=/
Expand Down Expand Up @@ -140,7 +141,7 @@ COPY ./requirements.txt ./requirements.txt
RUN --mount=type=cache,target=/root/.cache/pip \
pip install --upgrade pip setuptools && \
pip install -r requirements.txt && \
python -m pip uninstall -y pip setuptools && \
python -m pip uninstall -y pip setuptools wheel && \
rm -r /usr/local/lib/python3.10/ensurepip

USER permit
Expand Down
7 changes: 4 additions & 3 deletions requirements.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,9 +1,9 @@
aiohttp>=3.12.14,<4
aiohttp>=3.13.3,<4
fastapi>=0.115.6,<1
Jinja2>=3.1.2,<4
pydantic[email]>=1.9.1,<2
requests>=2.32.4,<3
urllib3>=2.5.0,<3
urllib3>=2.6.3,<3
gunicorn>=23.0.0,<24
tenacity>=8.0.1,<9
typer>=0.4.1,<1
Expand All @@ -15,6 +15,7 @@ scalar-fastapi==1.0.3
httpx>=0.27.0,<1
# TODO: change to use re2 in the future, currently not supported in alpine due to c++ library issues
# google-re2 # use re2 instead of re for regex matching because it's simiplier and safer for user inputted regexes
protobuf>=3.20.2 # not directly required, pinned by Snyk to avoid a vulnerability
protobuf>=6.33.5 # pinned to avoid CVE-2026-0994
cryptography>=46.0.5,<47 # pinned to avoid CVE-2026-26007
opal-common==0.8.3
opal-client==0.8.3
Loading