LCORE-534: Mitigate CVE GHSA-wj6h-64fc-37mp - remove python-ecdsa #460
Conversation
WalkthroughAdds a builder-stage step in Containerfile to uninstall the Python package ecdsa using uv pip uninstall after bundle sync, with comments referencing CVE GHSA-wj6h-64fc-37mp and noting python-jose defaults to cryptography. Ensures ecdsa is absent from the app-root copied into the final image. No other logic changed. Changes
Sequence Diagram(s)sequenceDiagram
autonumber
participant Dev as Containerfile
participant Builder as Builder Stage
participant AppRoot as /opt/app-root
participant Final as Final Image
Dev->>Builder: Build with uv + bundle sync
Builder->>Builder: Uninstall ecdsa (uv pip uninstall ecdsa)
note right of Builder: Remove ecdsa to mitigate GHSA-wj6h-64fc-37mp
Builder->>AppRoot: Produce cleaned app-root (no ecdsa)
AppRoot->>Final: Copy app-root into final image
Final-->>Dev: Image built without ecdsa
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Suggested reviewers
Poem
Tip 🔌 Remote MCP (Model Context Protocol) integration is now available!Pro plan users can now connect to remote MCP servers from the Integrations page. Connect with popular remote MCPs such as Notion and Linear to add more context to your reviews and chats. ✨ Finishing Touches🧪 Generate unit tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. CodeRabbit Commands (Invoked using PR/Issue comments)Type Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (2)
Containerfile (2)
30-35: Prefer removing ecdsa at the source (pyproject/lock) rather than post-sync uninstallUninstalling post-sync makes the image correct but leaves the repo state inconsistent: a fresh
uv syncwill reintroduceecdsa. Recommend:
- Declare
python-jose[cryptography]in pyproject to force the cryptography backend.- Regenerate
uv.locksoecdsais no longer resolved.Example (pyproject snippet):
- python-jose>=3.x + python-jose[cryptography]>=3.x
30-34: Tiny doc nit: clarify scope of safety claimThe comment says it’s safe to remove because python-jose defaults to cryptography. Consider adding “provided no code forces the ecdsa backend at runtime or relies on its specific API.” This keeps expectations explicit for future readers.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
💡 Knowledge Base configuration:
- MCP integration is disabled by default for public repositories
- Jira integration is disabled by default for public repositories
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (1)
Containerfile(1 hunks)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
- GitHub Check: build-pr
- GitHub Check: e2e_tests
🔇 Additional comments (1)
Containerfile (1)
30-35: No ecdsa imports, dependency references, or ES usages detected and python-jose is pinned with only the “cryptography” extra. Removal is safe.*
tisnik
left a comment
tisnik
left a comment
There was a problem hiding this comment.
maybe the -y CLI option will be good to have there
2 participants
Description
LCORE-534: Mitigate CVE GHSA-wj6h-64fc-37mp - remove python-ecdsa
Type of change
Related Tickets & Documents
Checklist before requesting a review
Testing
Summary by CodeRabbit
Bug Fixes
Chores