fix(security): refresh CI and gateway image dependencies#1432
Merged
Conversation
johntmyers
requested review from
a team,
derekwaynecarr,
maxamillion and
mrunalp
as code owners
|
🌿 Preview your docs: https://nvidia-preview-pr-1432.docs.buildwithfern.com/openshell |
TaylorMutch
previously approved these changes
May 18, 2026
|
Label |
johntmyers
force-pushed
the
security-image-remediation/jm
branch
from
1b8f8e2 to
bb7d962
Compare
Refresh the CI image tool pins so Go-built tools are rebuilt with patched Go releases and move the sandbox Python runtime to 3.14.5. Rebase the gateway runtime to a pinned distroless Debian 13 image with glibc 2.41-12+deb13u3 while preserving the existing UID/GID 1000 runtime identity for upgrade compatibility. Update rustls-webpki to 0.103.13 and clarify Linux k3d guidance now that k3d is not installed through mise on Linux. Signed-off-by: John Myers <9696606+johntmyers@users.noreply.github.com>
johntmyers
force-pushed
the
security-image-remediation/jm
branch
from
bb7d962 to
9cb3df1
Compare
TaylorMutch
approved these changes
May 18, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Refreshes the CI image toolchain and gateway runtime image to address reported container scan findings. The CI image moves to patched Go-built tool releases, Python 3.14.5, and omits the vulnerable Linux k3d binary from Linux installs. The gateway runtime rebases to pinned distroless Debian 13 with glibc 2.41-12+deb13u3 while preserving the existing UID/GID 1000 runtime identity for upgrade compatibility.
Related Issue
Security scan report provided out of band.
Changes
gcr.io/distroless/cc-debian13:nonroot@sha256:e1fd250ce83d94603e9887ec991156a6c26905a6b0001039b7a43699018c0733while keeping gateway and Helm defaults at UID/GID 1000.rustls-webpkito0.103.13..codex/state so pre-commit license checks do not scan machine-local agent files.Testing
mise run pre-commitmise run helm:lintmise run helm:testmise install --locked --dry-runexcludes k3d from CI installs.1000:1000runtime user configuration.Checklist