diff --git a/CHANGELOG.md b/CHANGELOG.md index bb83180b7..655772afa 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -16,6 +16,8 @@ and this project adheres to ### Fixed +- 🔒️(docker) distrust compromised eMudhra emSign G3 CA roots + ## [1.36.0] - 2026-10-20 ### Added diff --git a/Dockerfile b/Dockerfile index c55dfba74..509f47e4f 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,14 +1,16 @@ # Django Meet # ---- base image to inherit from ---- -FROM python:3.13.15-alpine3.24 AS base +FROM python:3.13.16-alpine3.24 AS base # Upgrade pip to its latest release to speed up dependencies installation RUN python -m pip install --upgrade pip # Upgrade system packages to install security updates RUN apk update && \ - apk upgrade + apk upgrade && \ + apk add --no-cache --upgrade 'ca-certificates>=20261020-r0' && \ + update-ca-certificates # ---- Back-end builder image ---- FROM base AS back-builder @@ -23,7 +25,7 @@ ENV UV_LINK_MODE=copy ENV UV_PYTHON_DOWNLOADS=0 # install uv -COPY --from=ghcr.io/astral-sh/uv:0.10.9 /uv /uvx /bin/ +COPY --from=ghcr.io/astral-sh/uv:0.13.4 /uv /uvx /bin/ WORKDIR /app @@ -39,6 +41,8 @@ RUN --mount=type=cache,target=/root/.cache/uv \ # ---- mails ---- FROM node:22-alpine AS mail-builder +RUN apk upgrade --no-cache ca-certificates + COPY ./src/mail /mail/app WORKDIR /mail/app @@ -120,7 +124,7 @@ USER root:root RUN apk add postgresql-client # Install development dependencies -RUN --mount=from=ghcr.io/astral-sh/uv:0.10.9,source=/uv,target=/bin/uv \ +RUN --mount=from=ghcr.io/astral-sh/uv:0.13.4,source=/uv,target=/bin/uv \ uv sync --all-extras --locked # Restore the un-privileged user running the application diff --git a/docker/dinum-frontend/Dockerfile b/docker/dinum-frontend/Dockerfile index cf7736562..883dfb7a5 100644 --- a/docker/dinum-frontend/Dockerfile +++ b/docker/dinum-frontend/Dockerfile @@ -1,6 +1,8 @@ # ---- Front-end image ---- FROM node:22-alpine AS frontend-deps +RUN apk upgrade --no-cache ca-certificates + WORKDIR /home/frontend/ COPY ./src/frontend/package.json ./package.json @@ -41,6 +43,8 @@ COPY ./docker/dinum-frontend/fonts/ \ # ---- Addons builder image ---- FROM node:20-alpine AS addons-builder +RUN apk upgrade --no-cache ca-certificates + WORKDIR /home/addons/outlook COPY ./src/addons/outlook/package.json ./package.json @@ -54,12 +58,12 @@ RUN npx webpack --mode production # ---- Front-end image ---- -FROM nginxinc/nginx-unprivileged:1.30.4-alpine3.24 AS frontend-production +FROM nginxinc/nginx-unprivileged:1.30.5-alpine3.24 AS frontend-production USER root RUN apk upgrade --no-cache libexpat && \ apk add --no-cache --upgrade 'pcre2>=10.49-r0' 'tiff>=4.7.2-r0' \ - 'libx11>=1.8.14-r0' && \ + 'libx11>=1.8.14-r0' 'ca-certificates>=20261020-r0' && \ apk del curl USER nginx diff --git a/src/agents/Dockerfile b/src/agents/Dockerfile index 044fa0a1c..c2a3576cb 100644 --- a/src/agents/Dockerfile +++ b/src/agents/Dockerfile @@ -1,8 +1,9 @@ -FROM python:3.14.7-slim AS base +FROM python:3.14.8-slim AS base # Install system dependencies required by LiveKit, fetching packages over HTTPS only for Bureautix proxy RUN sed -i "s|^URIs: http://|URIs: https://|" /etc/apt/sources.list.d/debian.sources \ && apt-get update && apt-get install -y --no-install-recommends \ + ca-certificates \ libglib2.0-0 \ libgobject-2.0-0 \ libpcre2-8-0 \ @@ -18,7 +19,7 @@ ENV UV_COMPILE_BYTECODE=1 \ UV_PYTHON_DOWNLOADS=0 # Install uv -COPY --from=ghcr.io/astral-sh/uv:0.10.9 /uv /uvx /bin/ +COPY --from=ghcr.io/astral-sh/uv:0.13.4 /uv /uvx /bin/ WORKDIR /app @@ -41,7 +42,7 @@ ENV UV_COMPILE_BYTECODE=1 \ UV_LINK_MODE=copy \ UV_PYTHON_DOWNLOADS=0 -COPY --from=ghcr.io/astral-sh/uv:0.10.9 /uv /uvx /bin/ +COPY --from=ghcr.io/astral-sh/uv:0.13.4 /uv /uvx /bin/ WORKDIR /app diff --git a/src/agents/uv.lock b/src/agents/uv.lock index 5e3a51983..a99ec688e 100644 --- a/src/agents/uv.lock +++ b/src/agents/uv.lock @@ -314,11 +314,11 @@ wheels = [ [[package]] name = "certifi" -version = "2026.7.22" +version = "2026.10.19" source = { registry = "https://pypi.org/simple" } -sdist = { url = "https://files.pythonhosted.org/packages/a3/c2/24167ea9858356b47a87a50d39908bfdb72ceeefe0041586e704e5376b3a/certifi-2026.7.22.tar.gz", hash = "sha256:741e2c3b351ddf169a738da9f2c048608ff7f2c5cc02f1ebc6b118bb090d5d55", size = 138112, upload-time = "2026-07-22T03:35:12.644Z" } +sdist = { url = "https://files.pythonhosted.org/packages/a6/bd/1436c50cc46699de0230fbaacc1d1de7bfec413176099949e9d5112e88f2/certifi-2026.10.19.tar.gz", hash = "sha256:035c1e85572b141bf1c3a3eff0e33a8eb74917522f2559075ff8d2fea780a1ae", size = 137598, upload-time = "2026-10-20T02:24:16.604Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/0b/a7/71ac2cff56fec219ed242bb11b8efb69fcc4bec75db06fb7bfe35de520e6/certifi-2026.7.22-py3-none-any.whl", hash = "sha256:62f22742b58a1a33014a2b6b706588a8d7e2a88ae7bd1a6ebe8c992928483775", size = 136983, upload-time = "2026-07-22T03:35:11.276Z" }, + { url = "https://files.pythonhosted.org/packages/c4/51/29046e48f693c54e5b7412216d447a1d8362c9653148d98c02cdf65fa733/certifi-2026.10.19-py3-none-any.whl", hash = "sha256:42d35340cc5b9ba78e818ddbff0c5b1c2b779de448a340fd1b989f5fa8670e1b", size = 136464, upload-time = "2026-10-20T02:24:15.072Z" }, ] [[package]] diff --git a/src/backend/uv.lock b/src/backend/uv.lock index f0f25125a..81af6aec9 100644 --- a/src/backend/uv.lock +++ b/src/backend/uv.lock @@ -316,11 +316,11 @@ redis = [ [[package]] name = "certifi" -version = "2026.7.22" +version = "2026.10.19" source = { registry = "https://pypi.org/simple" } -sdist = { url = "https://files.pythonhosted.org/packages/a3/c2/24167ea9858356b47a87a50d39908bfdb72ceeefe0041586e704e5376b3a/certifi-2026.7.22.tar.gz", hash = "sha256:741e2c3b351ddf169a738da9f2c048608ff7f2c5cc02f1ebc6b118bb090d5d55", size = 138112, upload-time = "2026-07-22T03:35:12.644Z" } +sdist = { url = "https://files.pythonhosted.org/packages/a6/bd/1436c50cc46699de0230fbaacc1d1de7bfec413176099949e9d5112e88f2/certifi-2026.10.19.tar.gz", hash = "sha256:035c1e85572b141bf1c3a3eff0e33a8eb74917522f2559075ff8d2fea780a1ae", size = 137598, upload-time = "2026-10-20T02:24:16.604Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/0b/a7/71ac2cff56fec219ed242bb11b8efb69fcc4bec75db06fb7bfe35de520e6/certifi-2026.7.22-py3-none-any.whl", hash = "sha256:62f22742b58a1a33014a2b6b706588a8d7e2a88ae7bd1a6ebe8c992928483775", size = 136983, upload-time = "2026-07-22T03:35:11.276Z" }, + { url = "https://files.pythonhosted.org/packages/c4/51/29046e48f693c54e5b7412216d447a1d8362c9653148d98c02cdf65fa733/certifi-2026.10.19-py3-none-any.whl", hash = "sha256:42d35340cc5b9ba78e818ddbff0c5b1c2b779de448a340fd1b989f5fa8670e1b", size = 136464, upload-time = "2026-10-20T02:24:15.072Z" }, ] [[package]] diff --git a/src/frontend/Dockerfile b/src/frontend/Dockerfile index 2c30a0ef2..5ef119778 100644 --- a/src/frontend/Dockerfile +++ b/src/frontend/Dockerfile @@ -1,5 +1,7 @@ FROM node:22-alpine AS frontend-deps +RUN apk upgrade --no-cache ca-certificates + USER node WORKDIR /home/frontend/ @@ -45,12 +47,12 @@ ENV VITE_MEDIA_BASE_URL=${VITE_MEDIA_BASE_URL} RUN npm run build # ---- Front-end image ---- -FROM nginxinc/nginx-unprivileged:1.30.4-alpine3.24 AS frontend-production +FROM nginxinc/nginx-unprivileged:1.30.5-alpine3.24 AS frontend-production USER root RUN apk upgrade --no-cache libexpat && \ apk add --no-cache --upgrade 'pcre2>=10.49-r0' 'tiff>=4.7.2-r0' \ - 'libx11>=1.8.14-r0' && \ + 'libx11>=1.8.14-r0' 'ca-certificates>=20261020-r0' && \ apk del curl USER nginx diff --git a/src/summary/Dockerfile b/src/summary/Dockerfile index 84c8c52f4..f29b05a8a 100644 --- a/src/summary/Dockerfile +++ b/src/summary/Dockerfile @@ -1,4 +1,6 @@ -FROM python:3.13-alpine3.24 AS base +FROM python:3.13.16-alpine3.24 AS base + +RUN apk add --no-cache --upgrade 'ca-certificates>=20261020-r0' # Install ffmpeg for audio/video processing (format conversion, extraction, compression) diff --git a/src/summary/pyproject.toml b/src/summary/pyproject.toml index cf3b86911..6255e386f 100644 --- a/src/summary/pyproject.toml +++ b/src/summary/pyproject.toml @@ -4,6 +4,7 @@ name = "summary" version = "1.35.0" requires-python = ">=3.13" dependencies = [ + "certifi>=2026.10.19", "fastapi[standard]>=0.105.0", "uvicorn>=0.24.0", "pydantic>=2.5.0", diff --git a/src/summary/uv.lock b/src/summary/uv.lock index b5fe747c0..a431fa670 100644 --- a/src/summary/uv.lock +++ b/src/summary/uv.lock @@ -126,11 +126,11 @@ wheels = [ [[package]] name = "certifi" -version = "2026.7.22" +version = "2026.10.19" source = { registry = "https://pypi.org/simple" } -sdist = { url = "https://files.pythonhosted.org/packages/a3/c2/24167ea9858356b47a87a50d39908bfdb72ceeefe0041586e704e5376b3a/certifi-2026.7.22.tar.gz", hash = "sha256:741e2c3b351ddf169a738da9f2c048608ff7f2c5cc02f1ebc6b118bb090d5d55", size = 138112, upload-time = "2026-07-22T03:35:12.644Z" } +sdist = { url = "https://files.pythonhosted.org/packages/a6/bd/1436c50cc46699de0230fbaacc1d1de7bfec413176099949e9d5112e88f2/certifi-2026.10.19.tar.gz", hash = "sha256:035c1e85572b141bf1c3a3eff0e33a8eb74917522f2559075ff8d2fea780a1ae", size = 137598, upload-time = "2026-10-20T02:24:16.604Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/0b/a7/71ac2cff56fec219ed242bb11b8efb69fcc4bec75db06fb7bfe35de520e6/certifi-2026.7.22-py3-none-any.whl", hash = "sha256:62f22742b58a1a33014a2b6b706588a8d7e2a88ae7bd1a6ebe8c992928483775", size = 136983, upload-time = "2026-07-22T03:35:11.276Z" }, + { url = "https://files.pythonhosted.org/packages/c4/51/29046e48f693c54e5b7412216d447a1d8362c9653148d98c02cdf65fa733/certifi-2026.10.19-py3-none-any.whl", hash = "sha256:42d35340cc5b9ba78e818ddbff0c5b1c2b779de448a340fd1b989f5fa8670e1b", size = 136464, upload-time = "2026-10-20T02:24:15.072Z" }, ] [[package]] @@ -1489,6 +1489,7 @@ source = { editable = "." } dependencies = [ { name = "boto3" }, { name = "celery" }, + { name = "certifi" }, { name = "dockerflow" }, { name = "fastapi", extra = ["standard"] }, { name = "langfuse" }, @@ -1513,6 +1514,7 @@ dev = [ requires-dist = [ { name = "boto3", specifier = "==1.43.56" }, { name = "celery", specifier = "==5.6.3" }, + { name = "certifi", specifier = ">=2026.10.19" }, { name = "dockerflow", specifier = "==2026.3.4" }, { name = "fastapi", extras = ["standard"], specifier = ">=0.105.0" }, { name = "langfuse", specifier = "==4.14.1" },