fix(docker): refresh uv image for patched rustls-webpki (#51292) - #82084
Open
egilewski wants to merge 1 commit into
Open
fix(docker): refresh uv image for patched rustls-webpki (#51292)#82084egilewski wants to merge 1 commit into
egilewski wants to merge 1 commit into
Conversation
…#51292) The production Dockerfile copied uv and uvx from uv 0.11.6, whose embedded rustls-webpki 0.103.10 remained vulnerable even after Hermes application dependency locks had moved to patched versions. Pin the uv source stage to the audited 0.11.33 Python 3.13 trixie OCI index, whose binaries carry rustls-webpki 0.103.13, and lock the version/variant to its exact immutable digest in a deterministic regression contract. The same uv and uvx paths, CLI flows, multi-architecture image family, and final runtime remain unchanged. This is scoped to Docker-shipped uv binaries; host installers, CI-only uv versions, and unrelated application dependency findings remain outside the fix boundary. Focused Docker and packaging validation passed (83 tests, plus the implementation and compatibility adjacent checks), along with py_compile and diff checks. The full canonical suite could not start because this pooled checkout has no pytest virtualenv; the broader direct run's three failures were environmental missing dotenv/mcp imports. CodeRabbit was unavailable after both bounded seat-limit retries and was treated fail-open; the final deep security and compatibility reviews are clean, including the repaired digest binding regression. Fixes NousResearch#51292
alt-glitch
added
type/security
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
ghcr.io/astral-sh/uvsource used by Docker from 0.11.6 to audited 0.11.33 Python 3.13 trixie digest, carryingrustls-webpki0.103.13.Validation
py_compileand diff checks passed.Fixes #51292