Repository navigation
PER-17900: fix(docker): clear the fixable Python and OS findings in the images (setuptools, openssl, zlib, urllib3 floor) - #987
Merged
EliMoshkovich merged 4 commits intoOct 27, 2026
Conversation
…ors), Debian/Alpine security updates, urllib3 floor - Both build stages upgrade setuptools to >=84.1.0. The base image's 79.0.1 already met requires.txt's floor, so pip kept it: it carries CVE-2025-47273 and vendors jaraco.context 5.3.0 (CVE-2026-23949) and wheel 0.45.1 (CVE-2026-24049). 84.2.1 vendors jaraco.context 6.1.0 and wheel 0.46.3. - The Debian common stage runs apt-get upgrade (openssl/libssl3 deb12u2), and the Alpine one apk upgrade (zlib 1.3.2-r1): security updates the base images predate. - opal-common's urllib3 floor 2.2.2 -> 2.8.0 (CVE-2026-97687, CVE-2026-97689). The images already resolved 2.8.0; the floor keeps it there for every install. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
EliMoshkovich
requested review from
zeevmoney
and
a balanced review from Copilot
October 27, 2026 18:34
✅ Deploy Preview for opal-docs ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
zeevmoney
approved these changes
Oct 27, 2026
zeevmoney
left a comment
zeevmoney
left a comment
Member
There was a problem hiding this comment.
Approved — no CRITICAL or HIGH issues found.
Non-blocking:
- MEDIUM
docker/Dockerfile:19— setuptools now floats to the newest release while the images still use the deprecatedsetup.py install;pkg_resourcesleaves the images - LOW
docker/Dockerfile:17— comment attributes CVE-2025-47273 to setuptools < 84.1; it was fixed in 78.1.1 and the remaining report is pip's vendored copy - LOW
packages/opal-common/requires.txt:14— comment omits CVE-2026-97688, also fixed in 2.8.0
Details are in the inline comments on each line.
…n the comments - 'setuptools>=84.1.0,<85' in both build stages: the images still install OPAL with the deprecated setup.py install, so an unpinned new major could break an unchanged rebuild. 82 and later already dropped pkg_resources. - The setuptools comment names what 79.0.1 actually carries (CVE-2026-59890, GHSA-xmj3-9gf7-h52w); CVE-2025-47273 was fixed in 78.1.1. - urllib3's comment lists CVE-2026-97688 as well. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
PER-17900
Clears the fixable HIGH/CRITICAL findings in the OPAL images that don't come from the bundled OPA binary; #906 bumps that binary. Found by a full scan of all four images (
client,server, Debian and Alpine) with Trivy and Grype on master 5f0e875, ahead of 0.10.0-rc.2.Changes
requires.txt'ssetuptools>=78.1.1, so pip never upgrades itpip install --upgrade pip 'setuptools>=84.1.0,<85'(capped at the major: the images still use the deprecatedsetup.py install; moving to pip is PER-17907)apt-get upgrade -yin the Debian common stageapk upgrade --no-cachein the Alpine common stageurllib3>=2.8.0, so every install gets the fixsetuptools is upgraded in the image only, not as a package floor, so opal-common's PyPI consumers aren't pushed onto setuptools 84.
Remaining scanner findings outside this change are tracked in PER-17900.
For the release notes: setuptools 82 and later no longer ship
pkg_resources, soimport pkg_resourcesfails in these images. OPAL and its dependencies don't use it. An image builtFROM permitio/opal-clientthat installs a plugin relying on it needs to installsetuptools<82itself, or a fixed version of the plugin.Verified locally
The
serverandserver-alpinetargets, built from this branch:setup.py installof opal-common/opal-server,opal-server --helpTogether with #906, the images are re-scanned in full before 0.10.0-rc.2.
Description updated during review to match bee5a95 (setuptools 79.0.1's own advisories, CVE-2026-97688 for urllib3, setuptools capped below 85, the pkg_resources release note).
🤖 Generated with Claude Code