Etusivu Tutki Apua
Kirjaudu sisään
yunoadmin
/
bambuddy
peilaus alkaen https://github.com/maziggy/bambuddy
1
0
Haarauta 0
Tiedostot Esitykset 0 Wiki
Selaa lähdekoodia

security(docker): raise pip floor to 26.1.2 to match advisory fix version

The image upgraded pip to >=26.1, but PYSEC-2026-196's fix is specifically
26.1.2 (PYSEC-2026-2875/2876 are fixed in 26.1). The old floor could resolve
26.1.0/26.1.1, which are still vulnerable to PYSEC-2026-196. --upgrade already
grabbed the latest in practice; this makes the pin match the advisory exactly.
maziggy 1 kuukausi sitten
vanhempi
e609aa2ccb
sitoutus
286eb9bf4a
2 muutettua tiedostoa jossa 2 lisäystä ja 1 poistoa
Yhdistetty näkymä Näytä diff tilastot
  1. 1 0
      CHANGELOG.md
  2. 1 1
      Dockerfile

+ 1 - 0
CHANGELOG.md
Näytä tiedosto 

@@ -135,6 +135,7 @@ All notable changes to Bambuddy will be documented in this file.
 
 
 
 ### Security
 
 ### Security
 
 - **Bumped two frontend dev-tooling dependencies with denial-of-service advisories (GHSA-3jxr-9vmj-r5cp, GHSA-52cp-r559-cp3m)** — `brace-expansion` and `js-yaml`, both pulled in transitively by `eslint` (via `minimatch` and `@eslint/eslintrc`), were flagged by `npm audit`. They are build/lint-time tooling only and are not part of the shipped app, so no running Bambuddy install was ever exposed. `npm audit fix` couldn't move eslint to the patched versions on its own, so they're pinned to the fixed releases through the existing `overrides` block in `frontend/package.json` (`brace-expansion ^5.0.7`, `js-yaml ^4.3.0`). `npm audit` now reports zero vulnerabilities and eslint still runs clean.
 
 - **Bumped two frontend dev-tooling dependencies with denial-of-service advisories (GHSA-3jxr-9vmj-r5cp, GHSA-52cp-r559-cp3m)** — `brace-expansion` and `js-yaml`, both pulled in transitively by `eslint` (via `minimatch` and `@eslint/eslintrc`), were flagged by `npm audit`. They are build/lint-time tooling only and are not part of the shipped app, so no running Bambuddy install was ever exposed. `npm audit fix` couldn't move eslint to the patched versions on its own, so they're pinned to the fixed releases through the existing `overrides` block in `frontend/package.json` (`brace-expansion ^5.0.7`, `js-yaml ^4.3.0`). `npm audit` now reports zero vulnerabilities and eslint still runs clean.
 
+- **Raised the Docker image's pip floor to 26.1.2 (PYSEC-2026-196)** — The image already upgraded pip before installing requirements, but the floor was `pip>=26.1` while PYSEC-2026-196's fix is specifically 26.1.2 (the related PYSEC-2026-2875/2876 are fixed in 26.1). `--upgrade` grabbed the latest in practice, but the loose floor could resolve 26.1.0/26.1.1, which are still vulnerable; the pin now matches the advisory exactly. Build tooling only — pip is not part of the running app.
 
 
 
 ## [0.2.4.9] - 2026-07-07
 
 ## [0.2.4.9] - 2026-07-07

+ 1 - 1
Dockerfile
Näytä tiedosto 

@@ -54,7 +54,7 @@ RUN setcap cap_net_bind_service=+ep "$(readlink -f /usr/local/bin/python3)"
 
 # wheels (so a hostile wheel could hijack stdlib imports during install).
 
 # wheels (so a hostile wheel could hijack stdlib imports during install).
 
 COPY requirements.txt ./
 
 COPY requirements.txt ./
 
 RUN --mount=type=cache,target=/root/.cache/pip \
 
 RUN --mount=type=cache,target=/root/.cache/pip \
 
-    pip install --root-user-action=ignore --upgrade 'pip>=26.1' \
 
+    pip install --root-user-action=ignore --upgrade 'pip>=26.1.2' \
 
  && pip install --root-user-action=ignore -r requirements.txt
 
  && pip install --root-user-action=ignore -r requirements.txt
 
 
 
 # Copy backend
 
 # Copy backend