-
Notifications
You must be signed in to change notification settings - Fork 241
[ROB-1911] close cve in enforcer CVE-2025-6965 #464
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
WalkthroughAdds an apk install step in enforcer/Dockerfile to update Alpine indexes and install sqlite (3.49.2-r1) and sqlite-libs. Inserted after PATH setup and before WORKDIR. No removals. Changes
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes ✨ Finishing Touches🧪 Generate unit tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. CodeRabbit Commands (Invoked using PR/Issue comments)Type Other keywords and placeholders
CodeRabbit Configuration File (
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Actionable comments posted: 1
🧹 Nitpick comments (1)
enforcer/Dockerfile (1)
7-9
: Install only what you need; consider dropping thesqlite
CLI.If the goal is to remediate the sqlite CVE impacting the runtime library used by Python (
libsqlite3
), installingsqlite-libs
is typically sufficient. Thesqlite
package adds the CLI binary and increases image size.If the CLI is not required at runtime, apply:
-RUN apk add --no-cache --upgrade \ - sqlite-libs=3.49.2-r1 sqlite=3.49.2-r1 +RUN apk add --no-cache --upgrade \ + sqlite-libs=3.49.2-r1Confirm whether the CLI is actually used by enforcer before removing it. I can scan the repo for usages if helpful.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
enforcer/Dockerfile
(1 hunks)
🔇 Additional comments (1)
enforcer/Dockerfile (1)
7-9
: Pinned sqlite-libs version confirmed in Alpine 3.22
- The
python:3.12-alpine
image is based on Alpine 3.22- Alpine 3.22’s main repo provides
sqlite-libs
at exactly3.49.2-r1
¹, so the build will succeed as isIf you’d rather auto-track future revision bumps, you can unpin the revision or extract it to a build ARG. For example:
-RUN apk add --no-cache --upgrade \ - sqlite-libs=3.49.2-r1 sqlite=3.49.2-r1 +ARG SQLITE_VERSION=3.49.2-r1 # bump here when needed +RUN apk add --no-cache --upgrade \ + sqlite-libs=${SQLITE_VERSION} sqlite=${SQLITE_VERSION}Or, to always get the latest patched revision in this channel:
-RUN apk add --no-cache --upgrade \ - sqlite-libs=3.49.2-r1 sqlite=3.49.2-r1 +RUN apk add --no-cache --upgrade sqlite-libs sqlite¹ pkgs.alpinelinux.org/package/v3.22/main/x86_64/sqlite-libs
No description provided.