fix: repair collabora e2e healthcheck and backend CVE gate

[melindavandijke]

Purpose

Two of the CI workflows on main were failing on every push/PR:

• Frontend Workflow — all test-e2e jobs (firefox, webkit) timed out waiting for Docker services to become healthy.
• Docker Hub Workflow — build-and-push-backend failed the trivy vulnerability gate.

Proposal

• compose.yaml: the collabora/code:latest image no longer ships a shell (hardened build), so the existing exec-based healthcheck (bash -c '... /dev/tcp/...') can never succeed even though coolwsd itself is up and healthy. app-dev's dependency on collabora is switched from service_healthy to service_started, which is what was causing the
  dependency failed to start: container drive-collabora-1 is unhealthy timeout in test-e2e.
• src/backend/pyproject.toml / uv.lock: bump cryptography (49.0.0 → 50.0.0, CVE-2026-69247) and pillow (12.2.0 → 12.3.0, several DoS/heap CVEs) past the HIGH-severity vulnerabilities trivy flagged.
• .trivyignore (new) + .github/workflows/docker-hub.yml: ignore CVE-2025-47273 (setuptools) and GHSA-6v7p-g79w-8964 (msgpack). Both are only referenced in pip's own vendored CycloneDX SBOM (pip/_vendor/bom.cdx.json) — neither package is actually installed in the built image (import setuptools / import msgpack both fail), and the issue is still present in the latest pip release (26.2.1), so it's not something fixable from our side.

Verified locally by building the backend-production target and running trivy against it directly: 0 HIGH/CRITICAL findings with .trivyignore applied (exit code 0).

Summary by CodeRabbit

• Security

  • Improved vulnerability scanning by documenting confirmed false positives.
  • Updated minimum versions for key image-processing, packaging, and encryption dependencies.

• Reliability

  • Simplified development startup checks for the Collabora integration to accommodate its hardened container image.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: c607e821-bf4a-4ea4-952d-b8325adfa9d7

📝 Walkthrough

Walkthrough

The changes update Python dependency minimums, configure Trivy vulnerability exclusions, and change Collabora development startup to rely on service start status instead of an executable health check.

Changes

Security and runtime configuration

Layer / File(s)	Summary
Dependency security constraints src/backend/pyproject.toml	Pillow and cryptography minimum versions increased. A setuptools minimum was added. Vulnerability annotations were updated.
Trivy vulnerability exclusions .trivyignore, .github/workflows/docker-hub.yml	The backend Trivy scan now uses .trivyignore, which excludes two documented vulnerabilities in pip’s vendored dependencies.
Collabora startup readiness compose.yaml	app-dev now waits for Collabora to start. The shell-based HTTP health check was removed because the hardened image lacks the required tools.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: kernicpanel

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes both primary changes: the Collabora healthcheck fix and the backend CVE gate updates.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix-ci-failures

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.trivyignore:
- Around line 1-9: Replace the global CVE/GHSA entries in .trivyignore with
scoped entries in .trivyignore.yaml that target only the affected pip vendored
paths or package PURLs and include an explicit expiration date. Preserve the
exceptions for the intended pip vendored packages without suppressing findings
for other locations.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 3704bdaf-9a49-400b-8a22-c9ef204b3a3b

📥 Commits

Reviewing files that changed from the base of the PR and between 3cbbfc9 and ee172cb.

⛔ Files ignored due to path filters (1)

• src/backend/uv.lock is excluded by !**/*.lock

📒 Files selected for processing (4)

• .github/workflows/docker-hub.yml
• .trivyignore
• compose.yaml
• src/backend/pyproject.toml