Update deps & improve image security #457
Conversation
Fixes various CVEs in django, joserfc and urllib3
Fixes various CVEs
WalkthroughThis PR updates base images across multiple Docker services to newer patch versions, bumps application dependencies (Django, Next.js, i18next-cli), and implements non-root execution with adjusted file permissions across test and runtime containers for improved security. Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes
Poem
Pre-merge checks and finishing touches✅ Passed checks (3 passed)
✨ Finishing touches🧪 Generate unit tests (beta)
📜 Recent review detailsConfiguration used: defaults Review profile: CHILL Plan: Pro 📒 Files selected for processing (6)
🚧 Files skipped from review as they are similar to previous changes (4)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (8)
🔇 Additional comments (3)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 5
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
src/mta-out/Dockerfile (1)
66-82: Critical: Permission mismatch between directory creation and runtime user.Lines 66-72 create directories and certificates as root:
/etc/postfix/sasl/var/spool/postfix/privateand/var/spool/postfix/public- SSL certificates via
make-ssl-certHowever, line 81 switches to
USER nobodybefore the entrypoint runs. The nobody user will lack write permissions to these root-owned directories, which postfix requires for queue management and SASL authentication.Solutions:
- Add
RUN chown -R nobody:nogroupcommands for the necessary directories after creation- Handle permission setup in entrypoint.sh before dropping privileges
- Use a dedicated postfix user instead of nobody
🔎 Example fix - adjust ownership before switching users:
# Ensure self-signed certificates are available (can be overridden by env vars/mounts) RUN make-ssl-cert generate-default-snakeoil # We don't need the default sasldb2 file, we use the one in the chroot jail. RUN rm -rf /etc/sasldb2 +# Adjust ownership for nobody user +RUN chown -R nobody:nogroup /var/spool/postfix /etc/postfix/sasl + ENV PATH="/venv/bin:$PATH" ENV VIRTUAL_ENV=/venv ENV VIRTUAL_ENV_PROMPT=venv USER nobodyAlternatively, verify that entrypoint.sh handles these permissions appropriately:
#!/bin/bash # Description: Check if entrypoint.sh manages permissions for postfix directories rg -n -C5 'chown|chmod|setcap|gosu|su-exec' src/mta-out/entrypoint.sh
📜 Review details
Configuration used: defaults
Review profile: CHILL
Plan: Pro
⛔ Files ignored due to path filters (3)
src/backend/poetry.lockis excluded by!**/*.locksrc/frontend/package-lock.jsonis excluded by!**/package-lock.jsonsrc/mta-in/poetry.lockis excluded by!**/*.lock
📒 Files selected for processing (9)
src/backend/pyproject.toml(1 hunks)src/frontend/Dockerfile(1 hunks)src/frontend/package.json(2 hunks)src/mpa/rspamd/Dockerfile(2 hunks)src/mpa/tests/Dockerfile(1 hunks)src/mta-in/Dockerfile(1 hunks)src/mta-out/Dockerfile(2 hunks)src/socks-proxy/Dockerfile(2 hunks)src/socks-proxy/tests/Dockerfile(1 hunks)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (8)
- GitHub Check: build-front
- GitHub Check: docker-publish-socks-proxy / docker-build-push
- GitHub Check: test-e2e
- GitHub Check: test-front
- GitHub Check: lint-back
- GitHub Check: lint-front
- GitHub Check: check-api-state
- GitHub Check: test-back
🔇 Additional comments (9)
src/mta-out/Dockerfile (2)
83-83: Explicit entrypoint improves clarity.Adding an explicit
ENTRYPOINTinstruction enhances the Dockerfile's readability and makes the container's entry point clear.
2-2: Base image update from Bookworm to Trixie.The update from
python:3.13.5-slim-bookworm(Debian 12) topython:3.13.7-slim-trixie(Debian 13 stable) upgrades both Python and the base OS. The patch version bump (3.13.5 → 3.13.7) includes security and bug fixes. Over 63% of packages are updated in Trixie, with Python upgraded to 3.13. Applications should note Debian's adoption of PEP 668, which restricts system-wide pip installations—containerized applications typically handle this transparently.src/socks-proxy/Dockerfile (2)
7-7: Improved image size with --no-install-recommends.Consolidating the apt-get command with
--no-install-recommendsreduces image size by avoiding unnecessary packages while still maintaining required build dependencies.
26-27: SOCKS proxy port configuration is secure.The Dante SOCKS proxy is configured to listen on port 1080 (non-privileged, ≥1024) by default through the
PROXY_INTERNAL_PORTenvironment variable in entrypoint.sh. This means thenobodyuser has the necessary permissions to bind without requiring additional capabilities (setcap), and the security improvement from running as non-root is fully realized.src/frontend/Dockerfile (1)
1-1: Alpine compatibility verified—no problematic native dependencies found.Alpine uses musl libc instead of glibc, which can cause compatibility issues with certain packages. However, this project's dependencies are primarily pure JavaScript libraries (Next.js, React, and ecosystem tools) with no known glibc-dependent native modules like bcrypt, canvas, or sqlite3. The presence of
@rollup/rollup-linux-x64-muslin optionalDependencies indicates Alpine awareness, and modern Sass versions provide pre-built binaries for musl environments. The switch tonode:22-alpineis safe for this codebase.src/frontend/package.json (1)
68-68: Review of i18next-cli version 1.32.0 configuration is unnecessary—the current setup is properly configured.The project uses a well-formed
i18next.config.tswith modern settings (keySeparator: false,nsSeparator: false) and maintains 10 language locales across multiple namespaces. While the version jump is significant, no documented breaking changes exist between 1.5.5 and 1.32.0 in i18next-cli's public records. The extraction script (i18next-cli extract) is correctly defined in package.json, and the locale output structure is properly organized. If the extraction currently works without errors, no configuration updates are required.src/mpa/tests/Dockerfile (1)
10-10: Running tests asnobodyaligns with security best practices for non-root container execution. However, since these tests perform only HTTP requests to the rspamd service without creating files or artifacts, the specific file permission concerns mentioned are not applicable to this test suite.src/mpa/rspamd/Dockerfile (2)
4-4: LGTM! Security improvement by reducing attack surface.Adding
--no-install-recommendsprevents unnecessary package installations, reducing both the image size and potential security vulnerabilities. This aligns with container security best practices.
1-1: Debian 13 is now stable and suitable for production. Debian 13 (trixie) is the current stable distribution, initially released on August 9th, 2025, with version 13.2 released on November 15th, 2025. It is supported for the next 5 years. The base image update is appropriate.
| "cryptography==45.0.5", | ||
| "dj-database-url==2.3.0", | ||
| "django==5.1.13", | ||
| "django==5.1.15", |
There was a problem hiding this comment.
Upgrade to Django 5.1.15 addresses critical SQL injection and DoS vulnerabilities.
The patch version bump from 5.1.13 to 5.1.15 fixes a high-severity SQL injection vulnerability in FilteredRelation on PostgreSQL and a moderate-severity XML deserialization DoS vulnerability. Additionally, intermediate version 5.1.14 fixes Windows-specific DoS issues in redirect handling. The upgrade is security-critical.
🤖 Prompt for AI Agents
In src/backend/pyproject.toml at line 32, the Django dependency should be
upgraded to 5.1.15; update the version string from "django==5.1.13" (or current
minor pin) to "django==5.1.15", then regenerate/refresh your lockfile (poetry
lock / pip-tools compile / update dependency manager) and run the test suite to
ensure compatibility; commit the updated pyproject.toml and lockfile together.
| "i18next": "25.3.0", | ||
| "i18next-http-backend": "3.0.2", | ||
| "next": "15.5.8", | ||
| "next": "15.5.9", |
There was a problem hiding this comment.
Critical security update required — upgrade to Next.js 15.5.9.
The update from 15.5.8 to 15.5.9 addresses multiple critical vulnerabilities in React Server Components, including CVE-2025-55182 (CVSS 10.0 RCE), CVE-2025-55184 (CVSS 7.5 DoS), and CVE-2025-55183 (CVSS 5.3 source code exposure). The initial fix for CVE-2025-55184 was incomplete; a complete fix has been issued under CVE-2025-67779. Immediate upgrade is essential.
🤖 Prompt for AI Agents
In src/frontend/package.json around line 43, the Next.js dependency must be
upgraded from 15.5.8 to 15.5.9 to address multiple critical CVEs; update the
"next" entry to "15.5.9", then run your package manager (npm/yarn/pnpm) to
regenerate the lockfile (package-lock.json/yarn.lock/pnpm-lock.yaml), run the
test suite and a dependency audit (npm audit or equivalent), and commit both the
package.json and updated lockfile.
For smaller image size and to avoid critical CVEs in the slim base image
NielsCodes
force-pushed
the
security-fixes
branch
from
cd4a45b to
b8921d9
Compare
1 participant
Purpose
Bumps dependencies to fix critical and high severity CVEs.
Also introduces security measures for safer Docker images.
Proposal
apt-get installcommands.zlib. Also leads to 5% smaller image size.mta-outandrspamdDockerfiles.Summary by CodeRabbit
Chores
Security
✏️ Tip: You can customize this high-level summary in your review settings.