fix(security): remediate base image CVEs from docker scout scan - #42075
Merged
Conversation
CE share of a docker scout sweep of the shipped image. - Purge software-properties-common once add-apt-repository has registered the git-core PPA. It pulls in python3-launchpadlib, which drags python3-cryptography, python3-jwt and python3-httplib2 into the runtime image for 12 findings. The PPA source and its key outlive the tool. - mongo-tools Go toolchain 1.26.4 -> 1.26.5, clearing the stdlib findings. - Bump the x/net pin to 0.56.0 for Caddy and mongo-tools. Verified by building the dependency-package block in isolation: the three python packages and software-properties-common are gone, while git (2.54.0, still from the PPA), supervisord, mongod, mongosh and psql all work. The comment about x/text records a verified negative: a --replace only binds for a module Caddy actually requires, so pinning x/text there is a silent no-op. Documented rather than left as a trap for the next person.
…builder Mirrors the EE correction. The Caddy x/text --replace was previously removed on the mistaken belief it was a no-op; `go version -m` on the built binary shows it binds correctly (dep v0.38.0 => v0.39.0). Grepping a Go binary for module@version reports the pre-replace version, which is what produced the wrong call. Also adds the pin to the mongo-tools builder, whose shipped binaries carry an unreplaced x/text v0.38.0 — the version CVE-2026-56852 is flagged against.
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
WalkthroughChangesDocker image updates
Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related issues
Possibly related PRs
Suggested reviewers: Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
subrata71
marked this pull request as ready for review
July 31, 2026 18:36
wyattwalter
approved these changes
Aug 4, 2026
|
This PR has not seen activitiy for a while. It will be closed in 7 days unless further activity is detected. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Linear: https://linear.app/appsmith/issue/APP-15742
Why
docker scout cves --only-fixedon the shipped release image reports 176 fixable vulnerabilities. This is the CE-owned share of the base image fixes — the regions ofdeploy/docker/base.dockerfilethat CE and EE hold in common.Follows the same ownership split as #41873 (golang bump for the mongo-tools builder), #41808 (Caddy/xcaddy) and #41850 (mongo-tools from source).
What changed
software-properties-commonafteradd-apt-repository1.26.4→1.26.5stdlibfindingsx/netpin0.55.0→0.56.0(Caddy + mongo-tools)x/text→0.39.0pin (Caddy + mongo-tools)Why
software-properties-commoncan goIt exists solely for the
add-apt-repository -y ppa:git-core/ppacall, but drags inpython3-launchpadliband with itpython3-cryptography,python3-jwtandpython3-httplib2. The PPA's sources entry and signing key persist independently of the tool that wrote them, so purging after registration is safe.Verified by building the dependency-package block in isolation:
python3-cryptography,python3-jwt,python3-httplib2,python3-launchpadlib,software-properties-common— all removed, no.dist-infoleft behind.git 2.54.0(Ubuntu 24.04 ships 2.43, so the PPA is still active),supervisord 4.2.5,mongod 7.0.39,mongosh 2.9.2,psql 14.23— all working./etc/apt/sources.list.d/git-core-ubuntu-ppa-noble.sourcesstill present.On the Go pins
Verify these with
go version -m <binary>, not by grepping formodule@versionstrings — the grep reports the pre-replace version and makes a working pin look inert. Confirmed on the built binaries:Scope
EE-only parts of this file — the Keycloak upgrade and the Temporal builder — are handled separately in appsmith-ee#9404, matching the existing split (#9060 for Keycloak, #9155 / #9052 for Temporal). Nothing in this PR touches a region that does not exist in EE, so it should sync cleanly.
A full base-image rebuild and rescan was done on the EE side with both halves applied: 123 → 52 findings (−58%), high 42 → 20.
Summary by CodeRabbit