From 005ee7a6b17ed38fca651c5f6240a71dd7babef3 Mon Sep 17 00:00:00 2001 From: Jean-Baptiste PENRATH Date: Mon, 21 Sep 2026 12:07:32 +0200 Subject: [PATCH] =?UTF-8?q?=E2=AC=86=EF=B8=8F(all)=20bump=20distribution?= =?UTF-8?q?=20and=20package=20(#800)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Upgrade all deps according to security reports --- deploy/python-uv/Dockerfile | 4 ++-- src/backend/Dockerfile | 2 +- src/backend/uv.lock | 13 +++++++------ src/frontend/Dockerfile | 2 +- src/keycloak/Dockerfile | 2 +- src/mpa/rspamd/Dockerfile | 8 ++++++-- src/mta-in/Dockerfile.pymta | 2 +- src/mta-in/uv.lock | 13 +++++++------ src/socks-proxy/Dockerfile | 7 +++++-- 9 files changed, 31 insertions(+), 22 deletions(-) diff --git a/deploy/python-uv/Dockerfile b/deploy/python-uv/Dockerfile index 1f30f0be..b033b95c 100644 --- a/deploy/python-uv/Dockerfile +++ b/deploy/python-uv/Dockerfile @@ -12,10 +12,10 @@ # this image directly and we don't want compilers in production images. Each # service adds its own build deps in a build-only stage. -FROM debian:trixie-slim@sha256:28de0877c2189802884ccd20f15ee41c203573bd87bb6b883f5f46362d24c5c2 AS base +FROM debian:trixie-slim@sha256:a99cfc517144bc59b1978475ec53b46ecabec7e43635402ee5b77cc54cd1b20a AS base # Bump to force an apt refresh + security upgrade of the base OS. -ENV MIN_UPDATE_DATE="2026-07-08" +ENV MIN_UPDATE_DATE="2026-09-21" RUN < /dev/null diff --git a/src/mta-in/Dockerfile.pymta b/src/mta-in/Dockerfile.pymta index 53da2d82..7ce0beab 100644 --- a/src/mta-in/Dockerfile.pymta +++ b/src/mta-in/Dockerfile.pymta @@ -158,7 +158,7 @@ HEALTHCHECK --interval=30s --timeout=2s --start-period=15s \ # Uses cc-debian13 (C runtime only) + python-build-standalone from uv. No # shell, no package manager, no busybox utilities. Runs as uid 65532. # Debug with: docker run --entrypoint='' gcr.io/distroless/cc-debian13:debug-nonroot sh -FROM gcr.io/distroless/cc-debian13:nonroot AS runtime-distroless-prod +FROM gcr.io/distroless/cc-debian13:nonroot@sha256:54df941ed0d06a1bd95ef5e0ce391fd8d9f94b64782dc9a60062727849ee3f97 AS runtime-distroless-prod WORKDIR /app diff --git a/src/mta-in/uv.lock b/src/mta-in/uv.lock index d53b5189..03bb4f8c 100644 --- a/src/mta-in/uv.lock +++ b/src/mta-in/uv.lock @@ -26,14 +26,15 @@ wheels = [ [[package]] name = "anyio" -version = "4.12.1" +version = "4.15.1" source = { registry = "https://pypi.org/simple" } dependencies = [ { name = "idna" }, + { name = "typing-extensions", marker = "python_full_version < '3.15'" }, ] -sdist = { url = "https://files.pythonhosted.org/packages/96/f0/5eb65b2bb0d09ac6776f2eb54adee6abe8228ea05b20a5ad0e4945de8aac/anyio-4.12.1.tar.gz", hash = "sha256:41cfcc3a4c85d3f05c932da7c26d0201ac36f72abd4435ba90d0464a3ffed703", size = 228685, upload-time = "2026-01-06T11:45:21.246Z" } +sdist = { url = "https://files.pythonhosted.org/packages/a9/d2/f4d173e22df740bc37b1db102b386ba719b66e95b0f0d751f556b387e6d2/anyio-4.15.1.tar.gz", hash = "sha256:9f28306018cbd6d329e64a36d58256edff76dd996fe423bc957326e578b82a94", size = 276966, upload-time = "2026-09-05T10:42:39.44Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/38/0e/27be9fdef66e72d64c0cdc3cc2823101b80585f8119b5c112c2e8f5f7dab/anyio-4.12.1-py3-none-any.whl", hash = "sha256:d405828884fc140aa80a3c667b8beed277f1dfedec42ba031bd6ac3db606ab6c", size = 113592, upload-time = "2026-01-06T11:45:19.497Z" }, + { url = "https://files.pythonhosted.org/packages/12/b8/4bd346e22b28902df4d651910f5242c28d84e4a5c2435ca5c3f797ed7e2e/anyio-4.15.1-py3-none-any.whl", hash = "sha256:6152fdbbf9a77fdec97731721bebf7c4c44f7c29b424b0065826173efc7ed101", size = 132079, upload-time = "2026-09-05T10:42:37.923Z" }, ] [[package]] @@ -537,11 +538,11 @@ wheels = [ [[package]] name = "typing-extensions" -version = "4.15.0" +version = "4.16.0" source = { registry = "https://pypi.org/simple" } -sdist = { url = "https://files.pythonhosted.org/packages/72/94/1a15dd82efb362ac84269196e94cf00f187f7ed21c242792a923cdb1c61f/typing_extensions-4.15.0.tar.gz", hash = "sha256:0cea48d173cc12fa28ecabc3b837ea3cf6f38c6d1136f85cbaaf598984861466", size = 109391, upload-time = "2025-08-25T13:49:26.313Z" } +sdist = { url = "https://files.pythonhosted.org/packages/f6/cc/6253133b5bb138fc3306cebfbda2c520f545d36b5be2c7255cc528bb45d6/typing_extensions-4.16.0.tar.gz", hash = "sha256:dc983d19a509c94dba722ee6abd33940f7c05a89e243c47e907eb4db6f1a43e5", size = 113555, upload-time = "2026-07-02T08:40:05.92Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/18/67/36e9267722cc04a6b9f15c7f3441c2363321a3ea07da7ae0c0707beb2a9c/typing_extensions-4.15.0-py3-none-any.whl", hash = "sha256:f0fa19c6845758ab08074a0cfa8b7aecb71c999ca73d62883bc25cc018c4e548", size = 44614, upload-time = "2025-08-25T13:49:24.86Z" }, + { url = "https://files.pythonhosted.org/packages/49/d3/b8441a820a491ddfc024b0b0cf0393375b75ea13866d9c66727e54c2fc80/typing_extensions-4.16.0-py3-none-any.whl", hash = "sha256:481caa481374e813c1b176ada14e97f1f67a4539ce9cfeb3f350d78d6370c2e8", size = 45571, upload-time = "2026-07-02T08:40:04.659Z" }, ] [[package]] diff --git a/src/socks-proxy/Dockerfile b/src/socks-proxy/Dockerfile index 6f3fcae8..f91c6368 100644 --- a/src/socks-proxy/Dockerfile +++ b/src/socks-proxy/Dockerfile @@ -1,4 +1,4 @@ -FROM debian:trixie-slim AS base +FROM debian:trixie-slim@sha256:a99cfc517144bc59b1978475ec53b46ecabec7e43635402ee5b77cc54cd1b20a AS base ARG DANTE_VER=1.4.4 ARG DANTE_URL=https://fossies.org/linux/misc/dante-$DANTE_VER.tar.gz @@ -21,7 +21,10 @@ make make install EOR -FROM debian:trixie-slim AS runtime +FROM debian:trixie-slim@sha256:a99cfc517144bc59b1978475ec53b46ecabec7e43635402ee5b77cc54cd1b20a AS runtime + +# Bump to force an apt refresh + security upgrade of the base OS. +ENV MIN_UPDATE_DATE="2026-09-21" RUN <