diff --git a/.github/workflows/cd.yml b/.github/workflows/cd.yml index cc5042a..9f66c8e 100644 --- a/.github/workflows/cd.yml +++ b/.github/workflows/cd.yml @@ -50,6 +50,9 @@ jobs: permissions: contents: read packages: write + # SARIF upload to code scanning (the v0.1.0 run's upload step failed + # with "Resource not accessible by integration" without this). + security-events: write strategy: fail-fast: false matrix: diff --git a/requirements.txt b/requirements.txt index 01f18f7..a9150d9 100644 --- a/requirements.txt +++ b/requirements.txt @@ -23,10 +23,10 @@ pyvisa>=1.12.0 pyvisa-py>=0.5.0 # API & Web -fastapi>=0.100.0 +fastapi==0.141.1 uvicorn[standard]>=0.23.0 -python-multipart>=0.0.6 -python-jose[cryptography]>=3.3.0 +python-multipart==0.0.32 +python-jose[cryptography]==3.5.0 # Middleware used by all three services' main.py (rate limiting, session # signing, structured logging). These were pinned only in the per-service # requirements.txt, so a root-only install (and CI's unit job) could not import @@ -39,7 +39,7 @@ structlog>=24.1 # needs both; prometheus_client is imported at module level in # services/shared/observability/metrics.py. prometheus-client>=0.20 -prometheus-fastapi-instrumentator>=7.0 +prometheus-fastapi-instrumentator>=8,<9 # httpx — imported at module level in services/shared/auth/jwt.py (OIDC) and by # Starlette's TestClient. Was only in the per-service reqs. httpx>=0.24,<0.26 @@ -124,3 +124,12 @@ opentelemetry-instrumentation-fastapi>=0.46b0 opentelemetry-instrumentation-sqlalchemy>=0.46b0 opentelemetry-instrumentation-celery>=0.46b0 opentelemetry-instrumentation-redis>=0.46b0 + +# CVE hygiene (v0.1.0 Trivy gate): pinned alongside the jose 3.5 +# upgrade; 44.0.1 carries the CVE-2024-12797 fix and ships working +# wheels on every platform we build for. +cryptography==48.0.1 +msgpack>=1.2.1 +# something in the dependency tree downgrades setuptools below the +# CVE-2025-47273 fix; pin the floor explicitly. +setuptools>=78.1.1 diff --git a/services/analysis/Dockerfile b/services/analysis/Dockerfile index 5772179..de08656 100644 --- a/services/analysis/Dockerfile +++ b/services/analysis/Dockerfile @@ -14,7 +14,15 @@ RUN apt-get update && apt-get install -y --no-install-recommends \ && rm -rf /var/lib/apt/lists/* COPY services/analysis/requirements.txt . +# Toolchain first: stale wheel/setuptools (jaraco.context) carried +# fixable HIGH CVEs into every image (v0.1.0 Trivy gate). +RUN pip install --no-cache-dir --upgrade pip setuptools wheel RUN pip install --no-cache-dir -r requirements.txt +# Runtime containers don't need pip — and pip VENDORS msgpack/setuptools +# copies (pip/_vendor) that carry fixable-looking CVEs no pip release has +# patched yet; removing pip both clears the Trivy gate honestly and +# shrinks the attack surface. (Real setuptools stays installed.) +RUN python -m pip uninstall -y pip # services/shared is a sibling package; the analysis service imports from # it via `from services.shared...` and the legacy `from db.base...` style diff --git a/services/analysis/requirements.txt b/services/analysis/requirements.txt index 55327ec..1b48950 100644 --- a/services/analysis/requirements.txt +++ b/services/analysis/requirements.txt @@ -12,15 +12,15 @@ # ---------------------------------------------------------------------------- # Web framework # ---------------------------------------------------------------------------- -fastapi==0.104.1 +fastapi==0.141.1 uvicorn[standard]==0.24.0 -python-multipart==0.0.6 -starlette<0.28 +python-multipart==0.0.32 +starlette==1.3.1 # ---------------------------------------------------------------------------- # Validation / config # ---------------------------------------------------------------------------- -pydantic==2.5.0 +pydantic==2.13.4 python-dotenv==1.0.0 pyyaml>=6.0 @@ -35,7 +35,7 @@ alembic>=1.13.0 # ---------------------------------------------------------------------------- # Auth # ---------------------------------------------------------------------------- -python-jose[cryptography]==3.3.0 +python-jose[cryptography]==3.5.0 passlib[bcrypt]==1.7.4 # OIDC + session middleware (Phase 4.1) @@ -53,7 +53,7 @@ prometheus-client>=0.20 # fastapi==0.104.1 / starlette<0.28 pins below (a fresh `pip install` — i.e. the # Docker build — fails with ResolutionImpossible). 6.1.0 exposes the same # Instrumentator API and resolves cleanly with starlette 0.27. -prometheus-fastapi-instrumentator>=6.1,<7 +prometheus-fastapi-instrumentator>=8,<9 # ---------------------------------------------------------------------------- # Numerical & scientific @@ -117,3 +117,12 @@ opentelemetry-sdk>=1.25.0 opentelemetry-exporter-otlp>=1.25.0 opentelemetry-instrumentation-fastapi>=0.46b0 opentelemetry-instrumentation-sqlalchemy>=0.46b0 + +# CVE hygiene (v0.1.0 Trivy gate): pinned alongside the jose 3.5 +# upgrade; 44.0.1 carries the CVE-2024-12797 fix and ships working +# wheels on every platform we build for. +cryptography==48.0.1 +msgpack>=1.2.1 +# something in the dependency tree downgrades setuptools below the +# CVE-2025-47273 fix; pin the floor explicitly. +setuptools>=78.1.1 diff --git a/services/lims/Dockerfile b/services/lims/Dockerfile index 78db141..434e243 100644 --- a/services/lims/Dockerfile +++ b/services/lims/Dockerfile @@ -13,7 +13,15 @@ RUN apt-get update && apt-get install -y --no-install-recommends \ && rm -rf /var/lib/apt/lists/* COPY services/lims/requirements.txt . +# Toolchain first: stale wheel/setuptools (jaraco.context) carried +# fixable HIGH CVEs into every image (v0.1.0 Trivy gate). +RUN pip install --no-cache-dir --upgrade pip setuptools wheel RUN pip install --no-cache-dir -r requirements.txt +# Runtime containers don't need pip — and pip VENDORS msgpack/setuptools +# copies (pip/_vendor) that carry fixable-looking CVEs no pip release has +# patched yet; removing pip both clears the Trivy gate honestly and +# shrinks the attack surface. (Real setuptools stays installed.) +RUN python -m pip uninstall -y pip COPY services/shared /app/services/shared COPY services/lims/app /app/app diff --git a/services/lims/requirements.txt b/services/lims/requirements.txt index 3bb964b..46a8ef7 100644 --- a/services/lims/requirements.txt +++ b/services/lims/requirements.txt @@ -2,12 +2,12 @@ # Reconciled in Session 1.5 from a static import audit of services/lims/app/. # Web framework -fastapi==0.104.1 +fastapi==0.141.1 uvicorn[standard]==0.24.0 -python-multipart==0.0.6 +python-multipart==0.0.32 # Validation / config -pydantic==2.5.0 +pydantic==2.13.4 python-dotenv==1.0.0 # Database @@ -15,7 +15,7 @@ sqlalchemy==2.0.23 psycopg[binary]==3.1.13 # Auth -python-jose[cryptography]==3.3.0 +python-jose[cryptography]==3.5.0 passlib[bcrypt]==1.7.4 # OIDC + session middleware (Phase 4.1) @@ -33,7 +33,7 @@ prometheus-client>=0.20 # fastapi==0.104.1 / starlette<0.28 pins (a fresh `pip install` — the Docker # build — fails with ResolutionImpossible). 6.1.0 exposes the same Instrumentator # API and resolves cleanly with starlette 0.27. -prometheus-fastapi-instrumentator>=6.1,<7 +prometheus-fastapi-instrumentator>=8,<9 # Reporting / labels jinja2>=3.1 @@ -51,3 +51,12 @@ opentelemetry-sdk>=1.25.0 opentelemetry-exporter-otlp>=1.25.0 opentelemetry-instrumentation-fastapi>=0.46b0 opentelemetry-instrumentation-sqlalchemy>=0.46b0 + +# CVE hygiene (v0.1.0 Trivy gate): pinned alongside the jose 3.5 +# upgrade; 44.0.1 carries the CVE-2024-12797 fix and ships working +# wheels on every platform we build for. +cryptography==48.0.1 +msgpack>=1.2.1 +# something in the dependency tree downgrades setuptools below the +# CVE-2025-47273 fix; pin the floor explicitly. +setuptools>=78.1.1 diff --git a/services/process_control/Dockerfile b/services/process_control/Dockerfile index c82bae0..a92b189 100644 --- a/services/process_control/Dockerfile +++ b/services/process_control/Dockerfile @@ -14,7 +14,15 @@ RUN apt-get update && apt-get install -y --no-install-recommends \ && rm -rf /var/lib/apt/lists/* COPY services/process_control/requirements.txt . +# Toolchain first: stale wheel/setuptools (jaraco.context) carried +# fixable HIGH CVEs into every image (v0.1.0 Trivy gate). +RUN pip install --no-cache-dir --upgrade pip setuptools wheel RUN pip install --no-cache-dir -r requirements.txt +# Runtime containers don't need pip — and pip VENDORS msgpack/setuptools +# copies (pip/_vendor) that carry fixable-looking CVEs no pip release has +# patched yet; removing pip both clears the Trivy gate honestly and +# shrinks the attack surface. (Real setuptools stays installed.) +RUN python -m pip uninstall -y pip COPY services/shared /app/services/shared COPY services/process_control/app /app/app diff --git a/services/process_control/requirements.txt b/services/process_control/requirements.txt index d65627f..181fc15 100644 --- a/services/process_control/requirements.txt +++ b/services/process_control/requirements.txt @@ -4,13 +4,13 @@ # added auth, async-jobs, and OPC-UA packages discovered by the audit. # FastAPI and web framework -fastapi==0.104.1 +fastapi==0.141.1 uvicorn[standard]==0.24.0 -python-multipart==0.0.6 +python-multipart==0.0.32 websockets==12.0 # Validation / config -pydantic==2.5.0 +pydantic==2.13.4 python-dotenv==1.0.0 # Database @@ -20,7 +20,7 @@ alembic==1.12.1 psycopg[binary]==3.1.13 # Auth -python-jose[cryptography]==3.3.0 +python-jose[cryptography]==3.5.0 passlib[bcrypt]==1.7.4 # Phase 4.2 — middleware (request-ID, rate limiting, structlog) @@ -35,7 +35,7 @@ prometheus-client>=0.20 # fastapi==0.104.1 / starlette<0.28 pins (a fresh `pip install` — the Docker # build — fails with ResolutionImpossible). 6.1.0 exposes the same Instrumentator # API and resolves cleanly with starlette 0.27. -prometheus-fastapi-instrumentator>=6.1,<7 +prometheus-fastapi-instrumentator>=8,<9 # Async / background jobs celery>=5.3,<6.0 @@ -75,3 +75,12 @@ opentelemetry-sdk>=1.25.0 opentelemetry-exporter-otlp>=1.25.0 opentelemetry-instrumentation-fastapi>=0.46b0 opentelemetry-instrumentation-sqlalchemy>=0.46b0 + +# CVE hygiene (v0.1.0 Trivy gate): pinned alongside the jose 3.5 +# upgrade; 44.0.1 carries the CVE-2024-12797 fix and ships working +# wheels on every platform we build for. +cryptography==48.0.1 +msgpack>=1.2.1 +# something in the dependency tree downgrades setuptools below the +# CVE-2025-47273 fix; pin the floor explicitly. +setuptools>=78.1.1 diff --git a/services/shared/tests/test_tracing.py b/services/shared/tests/test_tracing.py index 0ccd6a5..32d0ecc 100644 --- a/services/shared/tests/test_tracing.py +++ b/services/shared/tests/test_tracing.py @@ -46,6 +46,14 @@ def in_memory_exporter(): # provider — but if pytest gives us a fresh process, this is the # installation point. trace.set_tracer_provider(provider) + # set_tracer_provider is single-shot per process: when another suite + # (e.g. lims importing its app) already installed a provider, the call + # above no-ops and spans would flow to THAT provider — attach our + # exporter to whichever provider actually won, so the assertions hold + # regardless of test-collection order. + active = trace.get_tracer_provider() + if active is not provider and hasattr(active, "add_span_processor"): + active.add_span_processor(SimpleSpanProcessor(exporter)) return exporter