chore: upgrade libuuid in the runtime image - #540
Merged
Merged
Conversation
Trivy fails run_tests / docker_build on 7 HIGH CVEs in libuuid (util-linux 2.42.1-r0) inherited from python:3.13-alpine, turning the check red on every PR regardless of its contents. The runtime stage upgrades only a named list of base-image packages and libuuid was not on it. The fixed package (2.42.3-r1) is already published to the Alpine v3.24 repo, so adding it takes effect on the next build rather than waiting on an unbounded base-image rebuild. fixes #539 Claude-Session: https://claude.ai/code/session_01GkNnwDJBMZSLvhYjp8311Y
andrii-novikov
enabled auto-merge (squash)
September 8, 2026 07:17
VinShurik
approved these changes
Sep 8, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Applicable issues
Description of changes
Trivy fails
run_tests / docker_buildon 7 HIGH CVEs inlibuuid, inherited frompython:3.13-alpine, so every PR is red regardless of its contents.The runtime stage upgrades only a named list of base-image packages; this adds
libuuidto it. The fixed version is already published to the Alpinev3.24repo, so it takes effect on the next build.Verified locally: a baseline image off
developmentreproduces the 7 CVEs, the patched image scans clean and still starts.Checklist
[ ] Design documented is updated/created and approved by the team (if applicable)(one-line package upgrade)[ ] Documentation is updated/created (if applicable)(no behavior change)[ ] App schema changes are backward compatible, or breaking changes are documented with a migration guide(no app schema change)By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.