fix(#159): upgrade OS packages at build time to patch CVE-2026-31789#163
Merged
Conversation
Add apt-get upgrade to the production stage so every Docker build pulls the latest patched Debian packages. Fixes 3 critical OpenSSL findings (libssl3t64, openssl, openssl-provider-legacy) reported by Trivy.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pull Request
Summary
Adds
apt-get upgradeto the production Docker stage so every image build pulls the latest patched Debian packages. Fixes the 3 critical OpenSSL vulnerabilities reported by the weekly Trivy scan (issue #159).Changes
Dockerfile: addapt-get upgrade -y --no-install-recommendsto the production stageRUNstep alongside the existingapt-get installType
Testing
make docker-integrationpassed locally (required when touchingDockerfile,entrypoint.sh,docker-compose.yml, orpackages/parser-core/)The
scan-pr-imageCI job builds from source on this PR and will run Trivy — that scan result is the verification. No Python source changed so unit tests are unaffected.Checklist
Downstream impact
bankstatements_core(exported class, function, or exception)CVE details
libssl3t64opensslopenssl-provider-legacyAfter merge, cut
core-v0.1.4to publish:latestand clear the weekly scan.Closes #159