fix(security): pull expat 2.8.3-1~deb13u1 into the ingestion-base image - #31757
fix(security): pull expat 2.8.3-1~deb13u1 into the ingestion-base image#31757Khairajani wants to merge 5 commits into
Conversation
The image reports expat 2.8.2 for CVE-2026-72522 (DSA-6446-1: out-of-bounds read and resultant infinite loop in libexpat's *_toUtf16 surrogate handling); trixie-security has 2.8.3-1~deb13u1. expat is not in the python:3.12-slim-trixie base at all -- it comes in transitively from the top-of-file apt install -- and that layer is exactly why the image is stuck at 2.8.2: its cache key never changes, so it keeps resolving against the Debian index that was current when it was first built. Adding expat there would freeze the fix the same way. It goes in the late root layer instead, below the COPY and pip layers, where the index is re-read on every build -- the same reasoning that put util-linux there. expat rides in the existing dpkg source-package query rather than a second RUN, so one apt call covers both source packages and the next OS CVE is a one-line edit. The package set stays computed from dpkg rather than hand-listed for the reason already documented there: scanners report each binary of a source package separately, so a hand-written list silently leaves one behind. util-linux keeps its non-empty assert and expat deliberately does not get one. util-linux is Essential, so an empty query there means dpkg-query misbehaved and the build must stop; expat is transitive, so an empty query is a legitimate image with nothing to patch and failing on it would break the build for no reason. Asserting one of the two still covers the hazard the check exists for: `apt-get install --only-upgrade` with no package arguments exits 0, so an all-empty query would give a green build that shipped the vulnerable packages. Verified in a real build layer on python:3.12-slim-trixie: libexpat1 2.7.1-2 -> 2.8.3-1~deb13u1 and all nine util-linux binaries -> 2.41.5-0+deb13u1, exit 0. The expat-absent path was exercised on the bare base and also exits 0, upgrading util-linux alone. ingestion/Dockerfile gets no equivalent change because there is nothing to upgrade to, not because it is clean: apache/airflow:3.3.0-python3.12 is bookworm, Debian still marks bookworm and bookworm-security vulnerable, and the image already carries 2.5.0-1+deb12u2 -- the newest build either suite offers. It needs revisiting when Debian ships a bookworm fix.
❌ PR checklist incompleteThis PR cannot be merged until the following are addressed on its linked issue:
The fields live on the linked issue in the Shipping project (open the issue → right sidebar → Projects). After you set them, re-run this check (or push a commit) — issue/project changes do not re-trigger it automatically. Maintainers can bypass this check by adding the |
|
Hi there 👋 Thanks for your contribution! The OpenMetadata team will review the PR shortly! Once it has been labeled as Let us know if you need any help! |
✅ Playwright Results — workflow succeededValidated commit ✅ 110 passed · ❌ 0 failed · 🟡 0 flaky · ⏭️ 0 skipped · 🧰 0 lifecycle flaky PerformanceBlocking targets: ✅ met · Optimization targets: 🟡 in progress Shard-job maxima below are not the full workflow wall time; the linked run includes build, fixture, planning, and reporting. 🕒 Full workflow signal wall (to summary) 48m 33s ⏱️ Max setup 4m 16s · max shard execution 12m 28s · max shard-job elapsed before upload 17m 46s · reporting 5s 🌐 216.26 requests/attempt · 1.79 app boots/UI scenario · 0.00% common-shard skew Optimization targets still in progress:
How to debug locally# Download playwright-test-results-<shard> artifact and unzip
npx playwright show-trace path/to/trace.zip # view trace |
Khairajani
added
safe to test
🚦 Removed from the merge queue —
|
|
🚦 Removed from the merge queue —
|
🚦 Removed from the merge queue —
|
🚦 Removed from the merge queue —
|
Code Review ✅ ApprovedPulls expat 2.8.3-1~deb13u1 into the ingestion-base and CI Dockerfiles to resolve CVE-2026-72522. No issues found. OptionsDisplay: compact → Showing less information. Comment with these commands to change the behavior for this request:
Was this helpful? React with 👍 / 👎 | Powered by Gitar — free for open source |
Pull request was closed
2 participants
What
Adds
expatto the existing dpkg source-package upgrade in the late root layer ofingestion/operators/docker/DockerfileandDockerfile.ci.Why
The image reports expat 2.8.2 for CVE-2026-72522 (DSA-6446-1 — out-of-bounds read and resultant infinite loop in libexpat's
*_toUtf16surrogate handling). trixie-security has2.8.3-1~deb13u1.expat is not in the
python:3.12-slim-trixiebase at all — it arrives transitively from the top-of-fileapt-get install. That layer is exactly why the image is stuck at 2.8.2: its cache key never changes, so it keeps resolving against the Debian index that was current when it was first built. Adding expat there would freeze the fix the same way.It goes in the late root layer instead, below the COPY and pip layers, where the index is re-read on every build — the same reasoning that put util-linux there.
How
expat rides in the existing dpkg query rather than a second
RUN, so one apt call covers both source packages and the next OS CVE is a one-line edit:The package set stays computed from dpkg rather than hand-listed, for the reason already documented there: scanners report each binary of a source package separately, so a hand-written list silently leaves one behind.
util-linux keeps its non-empty assert and expat deliberately does not get one. util-linux is Essential, so an empty query there means
dpkg-querymisbehaved and the build must stop. expat is transitive, so an empty query is a legitimate image with nothing to patch — asserting it would break the build for no reason. Asserting one of the two still covers the hazard the check exists for:apt-get install --only-upgradewith no package arguments exits 0, so an all-empty query would give a green build that shipped the vulnerable packages.Dockerfile.cicarries its own copy of this block and gets the same change — it is the base that Collate's Snyk scan builds from.Verification
Ran the
RUNblock verbatim in a real build layer onpython:3.12-slim-trixie:libexpat12.7.1-22.8.3-1~deb13u12.41-52.41.5-0+deb13u1Exit 0. The expat-absent path was exercised separately on the bare base and also exits 0, upgrading util-linux alone — that path is real, since the base ships no expat.
Out of scope, deliberately
ingestion/Dockerfileis untouched because there is nothing to upgrade to, not because it is clean.apache/airflow:3.3.0-python3.12is bookworm; Debian's tracker still marks bookworm and bookworm-security vulnerable, and the image already carries2.5.0-1+deb12u2— the newest build either suite offers. Needs revisiting when Debian ships a bookworm fix.Related
Collate-side half: open-metadata/openmetadata-collate#5909 — the two must land together, or the collate image keeps shipping what the base tag was pinned to.
🤖 Generated with Claude Code
Greptile Summary
Adds expat binaries to the existing late-layer Debian security upgrade so ingestion-base images receive the fixed package from trixie-security.
Confidence Score: 5/5
The PR appears safe to merge.
No blocking failure remains.
Important Files Changed
Reviews (5): Last reviewed commit: "Merge branch 'main' into fix/expat-cve-2..." | Re-trigger Greptile