From 0b5317a77313697535f76e55b33d5c3d83f915f4 Mon Sep 17 00:00:00 2001 From: Quentin BEY Date: Mon, 19 Jan 2026 14:38:59 +0100 Subject: [PATCH] =?UTF-8?q?=F0=9F=94=92=EF=B8=8F(jaraco)=20enforce=20versi?= =?UTF-8?q?on=20to=20fix=20CVE?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Vulnerability in jaraco.context caused security issue in setuptools and python3. change python version to fix see GHSA-58pv-8j8x-9vj2 The CVE is not actionable, anyway, we want to please trivy. --- Dockerfile | 2 +- src/backend/pyproject.toml | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index 861049b..f634195 100644 --- a/Dockerfile +++ b/Dockerfile @@ -4,7 +4,7 @@ FROM python:3.13.3-alpine AS base # Upgrade pip to its latest release to speed up dependencies installation -RUN python -m pip install --upgrade pip setuptools +RUN python -m pip install --upgrade pip # Upgrade system packages to install security updates RUN apk update && \ diff --git a/src/backend/pyproject.toml b/src/backend/pyproject.toml index 57cf007..7fcbb87 100644 --- a/src/backend/pyproject.toml +++ b/src/backend/pyproject.toml @@ -46,6 +46,7 @@ dependencies = [ "easy_thumbnails==2.10.1", "factory_boy==3.3.3", "gunicorn==23.0.0", + "jaraco.context>=6.1.0", "jsonschema==4.25.1", "langfuse==3.10.0", "lxml==5.4.0",