Backport #2423 CVE fixes to release/v0.10.x - #2487
Merged
EItanya merged 2 commits intoAug 19, 2026
Merged
Conversation
**note**: upgrade, lint, and unit tests failing. I notice these failures in other PRs, so failures are unrelated to my changes. # Context - Resolving CVEs. - Removed unused pip that led to CVEs being caught for its existence (by Trivy, at least) -- I made a similar change in agentevals agentevals-dev/agentevals#182 - Set a minimum for `idna` - Bumped `UV_VERSION` - Set up a uv freeze + uv check to lint for python dependency management safety (ensuring version are based off the uv lockfile instead of bumped each time, possibly adding CVEs) **backend** | | Before | After | Fixes | | - | ----- | ----- | ---- | | CPython (via `UV_VERSION` `0.11.15 → 0.12.3`) | 3.13.9 | 3.13.15 | CVE-2026-3298, CVE-2026-4786, CVE-2026-6100, CVE-2026-7210, CVE-2026-9669, CVE-2026-1502, CVE-2026-3276, CVE-2026-6019, CVE-2026-7774, CVE-2026-8328 | | pip (bundled w/ interpreter) | 26.1.x | removed from image | CVE-2026-8643, GHSA-6v7p-g79w-8964, CVE-2025-47273, CVE-2026-59890 | | idna | 3.10 | 3.18 | CVE-2026-45409 | **ui** (no changes here, needs a rebuild of image to bump deps [on-release]) ## Summary **`app` image scan** | | C | H | M | Total | | - | - | - | - | ---- | | `main` | 1 | 10 | 15 | 26 | | PR | 1 | 5 | 8 | 14 | `golang-adk` clean, `skills-init` has 4 unresolvable CVEs (Alpine busybox/nghttp2) ## Remaining CVEs (15) **backend** - CPython (8): CVE-2026-11940, CVE-2026-11972, CVE-2026-15308 (high); CVE-2025-15366, CVE-2025-15367, CVE-2026-0864, CVE-2026-12003 — fixes exist **only** in the 3.15 line. Requires python bump 3.13 -> 3.15 (or waiting to see if they get back-ported to 3.13.x). - I'll re-verify this post-merge, there have been some recent python cve fixes I believe were backported _at least_ down to 3.14, unsure about 3.13. - Debian 12 base (6): glibc CVE-2026-5450, CVE-2026-5435, CVE-2026-5928, CVE-2026-6238, CVE-2026-6791, libssl3 CVE-2026-42767 — no fix shipped in bookworm image, will investigate migrating to chainguard in follow-ups. **ui** - CVE-2026-54876 — openssl/libssl3/libcrypto3, no wolfi patch published yet. the floating wolfi-base:latest will pick it up automatically on the first rebuild after wolfi ships it, so no need for updates here. --------- Signed-off-by: Fabian Gonzalez <fabian.gonzalez@solo.io> Co-authored-by: Eitan Yarmush <eitan.yarmush@solo.io>
EItanya
approved these changes
Aug 19, 2026
EItanya
enabled auto-merge (squash)
August 19, 2026 14:45
EItanya
disabled auto-merge
August 19, 2026 15:58
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Context
Trivy, at least) -- I made a similar change in agentevals
chore(security): target dependency lock for CVE fixes agentevals-dev/agentevals#182
idnaUV_VERSIONsafety (ensuring version are based off the uv lockfile instead of bumped
each time, possibly adding CVEs)
backend
UV_VERSION0.11.15 → 0.12.3)ui (no changes here, needs a rebuild of image to bump deps
[on-release])
Summary
appimage scanmaingolang-adkclean,skills-inithas 4 unresolvable CVEs (Alpinebusybox/nghttp2)
Remaining CVEs (15)
backend
CVE-2025-15366, CVE-2025-15367, CVE-2026-0864, CVE-2026-12003 — fixes
exist only in the 3.15 line. Requires python bump 3.13 -> 3.15 (or
waiting to see if they get back-ported to 3.13.x).
fixes I believe were backported at least down to 3.14, unsure about
3.13.
CVE-2026-6238, CVE-2026-6791, libssl3 CVE-2026-42767 — no fix shipped in
bookworm image, will investigate migrating to chainguard in follow-ups.
ui
yet. the floating wolfi-base:latest will pick it up automatically on the
first rebuild after wolfi ships it, so no need for updates here.
Signed-off-by: Fabian Gonzalez fabian.gonzalez@solo.io
Co-authored-by: Eitan Yarmush eitan.yarmush@solo.io