fix(security): clear the v0.1.0 Trivy gate — CVE upgrades + pip-less runtime images - #166
Merged
Merged
Conversation
…+ pip-less runtime images The second CD firing did its job: the Trivy HIGH/CRITICAL gate stopped the release on 11 fixable findings per image. All cleared, the honest way: Dependency upgrades (full suites green on the new set): - python-jose 3.3.0 → 3.5.0 — CRITICAL CVE-2024-33663 (ECDSA algorithm confusion) in OUR JWT LIBRARY. - python-multipart 0.0.6 → 0.0.32 (5 HIGH DoS CVEs — login form parsing runs through this). - fastapi 0.104.1 → 0.141.1 / starlette <0.28 → 1.3.1 (3 HIGH CVEs; starlette is fastapi-pinned so this is the coupled jump), pydantic 2.5.0 → 2.13.4, prometheus-fastapi-instrumentator >=8 (6.x cannot walk starlette 1.x routes — the one break the upgrade caused, caught by the lims suite going 66-red until the bump). - cryptography pinned 48.0.1 (2 HIGHs fixed vs 44.x; 49.0.0's macOS wheel is broken — 48.0.1 imports clean on every platform we build on). - msgpack >=1.2.1, setuptools >=78.1.1 explicit floors. Runtime images (all three backends): - Upgrade pip/setuptools/wheel BEFORE dependency install (stale toolchain carried fixable HIGHs into every image). - Then REMOVE pip from the runtime image entirely: pip 26.2 VENDORS msgpack 1.1.2 + setuptools 70.3.0 (pip/_vendor) with no patched pip release to move to — and runtime containers have no business installing packages anyway. Zero fixable HIGH/CRITICAL findings on the rebuilt image, verified with a --pull --no-cache build + local Trivy using the same flags as the gate. CD workflow: security-events: write on the build job (the SARIF upload failed "Resource not accessible by integration" without it). Tests: the shared tracing fixture now attaches its exporter to whichever tracer provider actually won the single-shot global slot, so the suite holds under any pytest collection order (the instrumentator upgrade surfaced a cross-suite pollution only reachable in combined invocations CI never runs — fixed anyway). Verified live: full compose stack rebuilt on the new set — migrate exit 0, all backends healthy, 4-test smoke green. Suites: analysis 304, pc 440, lims 68, shared 88. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The Trivy gate stopped the release on 11 fixable findings per image — all cleared honestly
security-events: write(SARIF upload was failing).Verified
Full compose stack rebuilt on the new set: migrate 0, backends healthy, smoke 4/4. Suites 304/440/68/88. After merge: re-point
v0.1.0→ third CD firing should clear every stage.🤖 Generated with Claude Code