From 2bc210cb90d9376430c5488a48cb57969c5d15a3 Mon Sep 17 00:00:00 2001 From: CarlosFelipeOR Date: Tue, 23 Jun 2026 02:02:02 -0300 Subject: [PATCH 1/3] Fix Grype Scan: pin boto3==1.43.33 to avoid botocore runtime ImportError (#1931) Signed-off-by: CarlosFelipeOR --- .github/workflows/grype_scan.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/grype_scan.yml b/.github/workflows/grype_scan.yml index ed9edeefe4b6..b6ac8e923bcd 100644 --- a/.github/workflows/grype_scan.yml +++ b/.github/workflows/grype_scan.yml @@ -50,7 +50,7 @@ jobs: sudo apt-get install -y python3-pip python3-venv python3 -m venv venv source venv/bin/activate - pip install --upgrade requests chardet urllib3 unidiff boto3 PyGithub + pip install --upgrade requests chardet urllib3 unidiff 'boto3==1.43.33' PyGithub pip install testflows==$TESTFLOWS_VERSION awscli==1.33.28 echo PATH=$PATH >>$GITHUB_ENV From b3e65a9ea8242b04c280091ae00cc0c7c45c4b61 Mon Sep 17 00:00:00 2001 From: CarlosFelipeOR Date: Wed, 24 Jun 2026 12:38:34 -0300 Subject: [PATCH 2/3] Update selected Ubuntu packages to fix CVEs Signed-off-by: CarlosFelipeOR --- docker/server/Dockerfile.ubuntu | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/docker/server/Dockerfile.ubuntu b/docker/server/Dockerfile.ubuntu index 6c76b8dee446..4b53d942fef5 100644 --- a/docker/server/Dockerfile.ubuntu +++ b/docker/server/Dockerfile.ubuntu @@ -8,6 +8,7 @@ ARG DEBIAN_FRONTEND=noninteractive ARG apt_archive="http://archive.ubuntu.com" # We shouldn't use `apt upgrade` to not change the upstream image. It's updated biweekly +# Exception: targeted --only-upgrade for selected packages to address CVEs without a general upgrade. # user/group precreated explicitly with fixed uid/gid on purpose. # It is especially important for rootless containers: in that case entrypoint @@ -27,7 +28,17 @@ RUN sed -i "s|http://archive.ubuntu.com|${apt_archive}|g" /etc/apt/sources.list tzdata \ wget \ gpgv \ + && apt-get install --yes --no-install-recommends --only-upgrade \ + libgnutls30 \ + libssl3 \ + openssl \ + libsystemd0 \ + libudev1 \ + libgcrypt20 \ + sed \ + liblzma5 \ && busybox --install -s \ + && apt-get clean \ && rm -rf /var/lib/apt/lists/* /var/cache/debconf /tmp/* #docker-official-library:off From 832da1df643bfd00546075d76875104d95248d44 Mon Sep 17 00:00:00 2001 From: CarlosFelipeOR Date: Wed, 1 Jul 2026 14:30:40 -0300 Subject: [PATCH 3/3] Upgrade Ubuntu packages to apply security fixes Signed-off-by: CarlosFelipeOR --- docker/server/Dockerfile.ubuntu | 16 ++++------------ 1 file changed, 4 insertions(+), 12 deletions(-) diff --git a/docker/server/Dockerfile.ubuntu b/docker/server/Dockerfile.ubuntu index 4b53d942fef5..64b9a40ae7cc 100644 --- a/docker/server/Dockerfile.ubuntu +++ b/docker/server/Dockerfile.ubuntu @@ -7,13 +7,13 @@ ARG DEBIAN_FRONTEND=noninteractive # ARG for quick switch to a given ubuntu mirror ARG apt_archive="http://archive.ubuntu.com" -# We shouldn't use `apt upgrade` to not change the upstream image. It's updated biweekly -# Exception: targeted --only-upgrade for selected packages to address CVEs without a general upgrade. +# Upgrade already installed Ubuntu packages to apply available security fixes +# without installing recommended packages. # user/group precreated explicitly with fixed uid/gid on purpose. # It is especially important for rootless containers: in that case entrypoint # can't do chown and owners of mounted volumes should be configured externally. -# We do that in advance at the begining of Dockerfile before any packages will be +# We do that in advance at the beginning of Dockerfile before any packages will be # installed to prevent picking those uid / gid by some unrelated software. # The same uid / gid (101) is used both for alpine and ubuntu. # Update gpgv to resolve CVE-2025-68973 @@ -28,15 +28,7 @@ RUN sed -i "s|http://archive.ubuntu.com|${apt_archive}|g" /etc/apt/sources.list tzdata \ wget \ gpgv \ - && apt-get install --yes --no-install-recommends --only-upgrade \ - libgnutls30 \ - libssl3 \ - openssl \ - libsystemd0 \ - libudev1 \ - libgcrypt20 \ - sed \ - liblzma5 \ + && apt-get upgrade --yes --no-install-recommends \ && busybox --install -s \ && apt-get clean \ && rm -rf /var/lib/apt/lists/* /var/cache/debconf /tmp/*