SYS-576 more dependency updates for python-builder / python-wsgi

instantlinux · Aug 8, 2023 · 34646fb · 34646fb
1 parent 5ff8f16
commit 34646fb
Show file tree

Hide file tree

Showing 7 changed files with 39 additions and 192 deletions.
diff --git a/.image-gitlab-ci.yml b/.image-gitlab-ci.yml
@@ -57,6 +57,7 @@ security_scan_trivy:
   - trivy image "${REGISTRY}/${IMAGE}:${TAG}" --severity LOW,MEDIUM
       --exit-code 0 --format table --output medium-vulns.txt
   - cat medium-vulns.txt
+  - echo CVE-2023-2253 > .trivyignore
   - trivy image "${REGISTRY}/${IMAGE}:${TAG}"
   cache:
     paths: [ .trivycache ]

diff --git a/images/python-builder/Dockerfile b/images/python-builder/Dockerfile
@@ -46,7 +46,7 @@ RUN addgroup -g $DOCKER_GID docker && \
       py3-pycryptodomex py3-greenlet \
       py3-itsdangerous py3-jinja2 py3-ldap3 py3-passlib \
       py3-pillow=$PYPILLOW_VERSION py3-pip py3-requests py3-virtualenv \
-      py3-werkzeug helm=$HELM_VERSION sqlite tar tzdata wget && \
+      py3-werkzeug helm=$HELM_VERSION sqlite tar tzdata wget libssl1.1 libcrypto1.1 && \
     cp /usr/share/zoneinfo/$TZ /etc/localtime && \
     echo $TZ >/etc/timezone && \
     mkdir -p /usr/lib/docker/cli-plugins && \

diff --git a/images/python-builder/Pipfile b/images/python-builder/Pipfile
@@ -5,7 +5,8 @@
 
 [packages]
 # alpine provides pre-built wheels for these
-Authlib = "==1.2.0"
+# loads of breaking changes in 1.2
+Authlib = "<1.0.0"
 babel = "==2.12.1"
 boto3 = "==1.26.132"
 botocore = "==1.29.132"
@@ -33,7 +34,7 @@ alembic = "*"
 arrow = "*"
 b2sdk = "*"
 celery = "*"
-connexion = "==2.7.0"
+connexion = "*"
 "connexion[swagger-ui]" = "*"
 coverage = "*"
 docopt = "*"
@@ -57,3 +58,7 @@ swagger-ui-bundle = "*"
 twine = "*"
 urllib3 = "*"
 wheel = "*"
+
+# Transitive dependencies
+# for jsonschema-spec 0.2.3
+referencing = "<0.30.0"
diff --git a/images/python-builder/Pipfile.lock b/images/python-builder/Pipfile.lock
diff --git a/images/python-wsgi/Pipfile b/images/python-wsgi/Pipfile
@@ -5,7 +5,8 @@
 
 [packages]
 # alpine provides pre-built wheels for these
-Authlib = "==1.2.0"
+# loads of breaking changes in 1.2
+Authlib = "<1.0.0"
 babel = "==2.12.1"
 boto3 = "==1.26.132"
 botocore = "==1.29.132"
@@ -34,7 +35,7 @@ werkzeug = "==2.2.3"
 alembic = "*"
 b2sdk = "*"
 celery = "*"
-connexion = "==2.7.0"
+connexion = "*"
 "connexion[swagger-ui]" = "*"
 docopt = "*"
 dollar-ref = "*"
@@ -49,3 +50,7 @@ SQLAlchemy = "<1.4.0"
 SQLAlchemy-Utils = "*"
 swagger-ui-bundle = "*"
 urllib3 = "*"
+
+# Transitive dependencies
+# for jsonschema-spec 0.2.3
+referencing = "<0.30.0"