-
[OPIK-6613] fix(deps): bump docker base + urllib3 to clear CRITICAL+HIGH CVEs in opik-python-backend (#6783)
frostbyte_neo 发布于
2026-05-20 15:25:29 +00:00 - [OPIK-6613] fix(deps): bump docker base 29.2.1 -> 29.5.1 in opik-python-backend
Trivy scan of self-hosted v4.17.1 release flagged opik-python-backend:2.0.39
with 3 unique CRITICAL CVEs (raw count 17 due to docker/containerd/runc/dockerd
being statically compiled with the same vulnerable Go deps):CVE-2026-33186 google.golang.org/grpc v1.76.0/v1.78.0 -> 1.79.3
(gRPC-Go authorization bypass via improper HTTP/2 path validation)
CVE-2026-31789 OpenSSL libcrypto3/libssl3/openssl 3.5.5-r0 -> 3.5.6-r0
(Heap buffer overflow on 32-bit systems from large X.509 cert)
CVE-2025-68121 Go stdlib crypto/tls v1.25.6 -> 1.25.7
(Incorrect cert validation during TLS session resumption)All three live in the docker/containerd/runc binaries that ship with the
docker:29.2.1base image. Bumping todocker:29.5.1(released 2026-05-19)
pulls in fixed Go (1.25.7+) + fixed grpc + Alpine 3.23.4 with openssl 3.5.6-r0.See OPIK-6613 for full per-image CVE report.
Co-Authored-By: Claude Opus 4.7 (1M context) noreply@anthropic.com
- [OPIK-6619] fix(deps): bump urllib3 2.6.3 -> 2.7.0 in opik-python-backend
Closes the remaining 2 HIGH CVE findings on opik-python-backend:2.0.39
that aren't fixed by the docker base bump in the parent commit:CVE-2026-44431 urllib3 2.6.3 -> 2.7.0
CVE-2026-44432 urllib3 2.6.3 -> 2.7.0Combined with the docker:29.2.1 -> 29.5.1 base bump (parent commit),
this PR now closes all CRITICAL + HIGH findings for the image
identified by the trivy scan of self-hosted v4.17.1.See OPIK-6613 (CRITICAL summary) and OPIK-6619 (this image's HIGH).
Co-Authored-By: Claude Opus 4.7 (1M context) noreply@anthropic.com
Co-authored-by: Claude Opus 4.7 (1M context) noreply@anthropic.com
下载附件