Skip to content

chore: apply security updates to docker images and python dependencies #2179

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
codyoss merged 2 commits into from
Jul 17, 2026
Merged

chore: apply security updates to docker images and python dependencies #2179

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
f1c12fd
chore: apply security updates to docker images and python dependencies
codyoss Jul 17, 2026
27a644d
remove bad merge conflict
codyoss Jul 17, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions docker/owlbot/nodejs/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,7 @@ WORKDIR /
# Install necessary tools, the default Python 3 (which is 3.11 on Debian 12),
# python3-venv for virtual environments, and xz-utils for Node.js archives.
RUN apt-get update && \
apt-get upgrade -y && \
apt-get install -y --no-install-recommends \
ca-certificates \
git \
Expand All @@ -32,8 +33,7 @@ RUN apt-get update && \
RUN apt-get update && \
apt-get install -y make build-essential libssl-dev zlib1g-dev libbz2-dev \
libreadline-dev libsqlite3-dev wget curl llvm libncurses5-dev libncursesw5-dev \
xz-utils tk-dev libffi-dev liblzma-dev && \
apt-get upgrade -y
xz-utils tk-dev libffi-dev liblzma-dev

WORKDIR /root

Expand Down Expand Up @@ -68,7 +68,7 @@ RUN pyenv install 3.13.12 && \

# This is needed to upgrade pip in the following path
# /root/.pyenv/versions/3.13.12/lib/python3.13/site-packages/
RUN pip install --upgrade pip
RUN pip install --upgrade pip setuptools wheel

# Create a Python virtual environment for synthtool dependencies.
# This isolates your Python packages from the system Python.
Expand All @@ -80,7 +80,7 @@ ENV PATH="$VIRTUAL_ENV/bin:$PATH"

# This is needed to upgrade pip in the following path
# /opt/venv/synthtool/lib/python3.13/site-packages/
RUN pip install --upgrade pip
RUN pip install --upgrade pip setuptools wheel

# TODO(https://github.com/python/cpython/issues/144538): This is
# need to address CVE-2026-1703 which requires pip 26.0
Expand Down
8 changes: 4 additions & 4 deletions docker/owlbot/nodejs_mono_repo/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,7 @@ WORKDIR /
# python3, python3-pip, and python3-venv are installed to provide Python 3.11 and
# the tools for creating virtual environments.
RUN apt-get update && \
apt-get upgrade -y && \
apt-get install -y --no-install-recommends \
ca-certificates \
git \
Expand All @@ -37,8 +38,7 @@ RUN apt-get update && \
RUN apt-get update && \
apt-get install -y make build-essential libssl-dev zlib1g-dev libbz2-dev \
libreadline-dev libsqlite3-dev wget curl llvm libncurses5-dev libncursesw5-dev \
xz-utils tk-dev libffi-dev liblzma-dev && \
apt-get upgrade -y
xz-utils tk-dev libffi-dev liblzma-dev

WORKDIR /root

Expand Down Expand Up @@ -73,7 +73,7 @@ RUN pyenv install 3.13.12 && \

# This is needed to upgrade pip in the following path
# /root/.pyenv/versions/3.13.12/lib/python3.13/site-packages/
RUN pip install --upgrade pip
RUN pip install --upgrade pip setuptools wheel

# Create a Python virtual environment for synthtool's dependencies.
# This isolates your Python packages from the system Python, preventing conflicts.
Expand All @@ -85,7 +85,7 @@ ENV PATH="$VIRTUAL_ENV/bin:$PATH"

# This is needed to upgrade pip in the following path
# /opt/venv/synthtool/lib/python3.13/site-packages/
RUN pip install --upgrade pip
RUN pip install --upgrade pip setuptools wheel

# TODO(https://github.com/python/cpython/issues/144538): This is
# need to address CVE-2026-1703 which requires pip 26.0
Expand Down
4 changes: 4 additions & 0 deletions docker/owlbot/php/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@ WORKDIR /
# Install necessary tools, the default Python 3 (which is 3.11 on Debian 12),
# python3-venv for virtual environments, and xz-utils for Node.js archives.
RUN apt-get update && \
apt-get upgrade -y && \
apt-get install -y --no-install-recommends \
ca-certificates \
git \
Expand Down Expand Up @@ -60,6 +61,9 @@ RUN python3 -m venv $VIRTUAL_ENV
# the venv for all subsequent commands in this and future RUN layers.
ENV PATH="$VIRTUAL_ENV/bin:$PATH"

# Upgrade pip, setuptools, and wheel in the virtual environment to patch their vulnerabilities
RUN pip install --upgrade pip setuptools wheel

# Copy requirements.txt and install Python dependencies into the virtual environment.
COPY requirements.txt /synthtool/requirements.txt
RUN pip install --require-hashes -r /synthtool/requirements.txt
Expand Down
1 change: 1 addition & 0 deletions docker/owlbot/python/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,7 @@
FROM marketplace.gcr.io/google/ubuntu2404

RUN apt-get update && \
apt-get upgrade -y && \
apt-get install -y --no-install-recommends \
# Essential for compiling C code
build-essential \
Expand Down
Loading
Loading