From 1ab386f24be717d3569e65ec4fe502011cf16abe Mon Sep 17 00:00:00 2001 From: Josh Knapp Date: Mon, 2 Nov 2026 08:25:58 -0800 Subject: [PATCH] fix(stt): upgrade the base image's pip and setuptools before installing python:3.11-slim ships CPython 3.11's frozen pip 24.0 and setuptools 79.0.1. OSV lists six pip advisories (CVE-2025-8869, CVE-2026-1703, CVE-2026-3219, CVE-2026-6357, CVE-2026-8643, CVE-2026-13346; fixed by 26.2) and two setuptools ones (CVE-2026-59890, GHSA-xmj3-9gf7-h52w; fixed by 84.1.0). Upgrading them first also means the app installs run under a patched pip. After the change the image resolves pip 26.2.2 and setuptools 84.2.1, and an OSV batch query over all 41 installed packages comes back clean (fastapi 0.162.0, starlette 1.10.0, python-multipart 0.0.33, uvicorn 0.54.0, faster-whisper 1.2.1, ...). Trivy finds no fixable Debian 13.7 OS vulnerabilities in the current python:3.11-slim, so no apt upgrade layer is added. Smoke-tested: /health 200 and /transcribe 200 on a generated WAV. Co-Authored-By: Claude Opus 5.5 --- stt-container/Dockerfile | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/stt-container/Dockerfile b/stt-container/Dockerfile index 3d1a912..aa91330 100644 --- a/stt-container/Dockerfile +++ b/stt-container/Dockerfile @@ -1,6 +1,14 @@ FROM python:3.11-slim -RUN pip install --no-cache-dir \ +# The python:3.11 images freeze the pip and setuptools that shipped with that +# CPython branch (pip 24.0, setuptools 79), and both have since collected +# advisories: pip path traversal / tar-symlink / index-URL handling +# (CVE-2025-8869, CVE-2026-1703, CVE-2026-3219, CVE-2026-6357, CVE-2026-8643, +# CVE-2026-13346) and setuptools sdist/legacy-wheel path issues +# (CVE-2026-59890, GHSA-xmj3-9gf7-h52w). Upgrade them first, so the installs +# below also run under a patched pip. +RUN pip install --no-cache-dir --upgrade "pip>=26.2" "setuptools>=84.1" \ + && pip install --no-cache-dir \ faster-whisper \ fastapi \ uvicorn[standard] \