Skip to content

fix: update jaraco.context to resolve CVE#74

Open
qued wants to merge 7 commits intomainfrom
fix/resolve-jaraco-context-cve
Open

fix: update jaraco.context to resolve CVE#74
qued wants to merge 7 commits intomainfrom
fix/resolve-jaraco-context-cve

Conversation

@qued
Copy link
Contributor

@qued qued commented Jan 14, 2026

Summary

GHSA-58pv-8j8x-9vj2 involves the Python package jaraco.context, which is past of the base Python toolchain (as opposed to unstructured-specific deps). This PR pulls in the fix

Test instructions

Grype scan should not show GHSA-58pv-8j8x-9vj2.


Note

Addresses security advisory GHSA-58pv-8j8x-9vj2 by removing vulnerable Python tooling from Docker images.

  • Uninstalls setuptools and purges pip cache in dockerfiles/wolfi-base/Dockerfile and dockerfiles/wolfi-py3.12-slim/Dockerfile
  • In wolfi-base, temporarily elevates to root for the uninstall, then restores the non-root user

Written by Cursor Bugbot for commit e54aedd. This will update automatically on new commits. Configure here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant