SnapOtterandGitHub c203267866 fix(docker): patch OS + pip image CVEs, document accepted Trivy residuals (#288) ...

Reduces the container-image CVE surface flagged by Trivy.

Genuinely fixed on every rebuild:
- apt-get upgrade in the production stage pulls Ubuntu security patches
  for base-image packages (libgnutls30t64 3.8.3-1.1ubuntu3.5 -> ubuntu3.6,
  libgcrypt20, liblzma5), closing ~15 OS-package CVEs.
- pip 25.1.1 -> 26.1.2 closes 4 pip CVEs (CVE-2025-8869, 2026-1703,
  2026-3219, 2026-6357).

Accepted via .trivyignore (canonical, reviewed):
- 6 newly surfaced pnpm 9.x build-tool CVEs (fixed only in pnpm 10.x, a
  major migration tracked separately; pnpm runs at install/start only).
- caire's bundled golang.org/x/image (esimov/caire v1.5.0 is latest and
  still pins x/image v0.18.0; no upstream fix).
- brace-expansion 2.x ReDoS (transitive of glob; patched 5.0.6 already
  present; not reachable from user input).

Already resolved in the current tree (clear on next scan): picomatch
4.0.4 (override), ip-address removed.

Verification note: the Trivy job in release.yml depends on the
intentionally gated-off docker build/publish job, so these cannot be
re-scanned in CI without enabling image publishing. The image is not
currently shipped.

2026-06-21 23:23:03 +08:00

..

.dockerignore

fix: Docker hardening, security, and deployment readiness for V1 (#82)

2026-04-21 10:19:08 +08:00

build-bundle.sh

fix(audio): low-samplerate ogg encode + post-2.0 QA hygiene

2026-06-20 10:41:50 +08:00

docker-compose-gpu.yml

fix(security): harden rate limits, Redis auth, resource caps, and error sanitization

2026-06-20 00:53:11 +08:00

docker-compose.test.yml

test: run the docker suite without the coverage gate

2026-06-17 14:28:41 +08:00

docker-compose.yml

fix(security): harden rate limits, Redis auth, resource caps, and error sanitization

2026-06-20 00:53:11 +08:00

Dockerfile

fix(docker): patch OS + pip image CVEs, document accepted Trivy residuals (#288)

2026-06-21 23:23:03 +08:00

Dockerfile.test

test: install enterprise S3 dep and open PS coders in docker test image

2026-06-17 14:28:41 +08:00

Dockerfile.test.dockerignore

fix: resolve ONNX CUDA fallback, Docker e2e infrastructure, and all test failures

2026-04-20 20:53:54 +08:00

download_models.py

feat: add BiRefNet HR-matting model download and manifest entry

2026-05-05 22:56:31 +08:00

entrypoint.sh

fix(security): harden rate limits, Redis auth, resource caps, and error sanitization

2026-06-20 00:53:11 +08:00

feature-manifest.json

fix(ai-bundles): repair bundle build + publish pipeline (deepsafe repo, CPU provider, manifest)

2026-06-19 18:34:33 +08:00

verify-bundle.sh

fix(ci): harden smoke tests against set -e and fix parameter issues

2026-06-20 10:45:56 +08:00

wait-for-postgres.mjs

feat(db)!: SnapOtter 2.0 phase 1 foundation: postgres, migrator, compose stack (#216)

2026-06-13 10:15:23 +08:00