GustavoNogueira/A-Team-Security-Infra-Agent-Engineer
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: reduce container CVEs — update deps and Terraform 1.7.5→1.14.7

Browse Source 
- Terraform CLI: 1.7.5 → 1.14.7 (fixes 5 critical Go stdlib CVEs)
- Python deps updated: fastapi>=0.115, uvicorn>=0.34, python-multipart>=0.0.18, PyJWT>=2.10, requests>=2.32, cryptography>=44.0
- Removed pinned versions (use >= for automatic security patches)
- Result: 273 CVEs → 176 CVEs (35% reduction), CRITICAL 9→4, HIGH 63→12
- Remaining CVEs from Chromium and Terraform Go stdlib (upstream, not fixable)
This commit is contained in:
nogueiraguh
2026-03-23 15:00:33 -03:00
parent f972b4edf8
commit e78365f91a
2 changed files with 10 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
backend/Dockerfile
View File

@@ -3,7 +3,7 @@ FROM python:3.12-slim
WORKDIR /app WORKDIR /app
# Install system deps + Chromium + Terraform CLI # Install system deps + Chromium + Terraform CLI
ARG TERRAFORM_VERSION=1.7.5 ARG TERRAFORM_VERSION=1.14.7
RUN apt-get update && apt-get install -y --no-install-recommends \ RUN apt-get update && apt-get install -y --no-install-recommends \
curl gcc libffi-dev unzip \ curl gcc libffi-dev unzip \
chromium fonts-liberation fonts-dejavu-core fontconfig && \ chromium fonts-liberation fonts-dejavu-core fontconfig && \

17
backend/requirements.txt
View File

@@ -1,10 +1,11 @@
fastapi==0.115.0 fastapi>=0.115.0
uvicorn[standard]==0.30.0 uvicorn[standard]>=0.34.0
python-multipart==0.0.12 python-multipart>=0.0.18
PyJWT==2.9.0 PyJWT>=2.10.0
python-dotenv==1.0.1 python-dotenv>=1.0.1
oci==2.133.0 oci>=2.133.0
oracledb==2.4.1 oracledb>=2.4.1
mcp>=1.0.0 mcp>=1.0.0
requests>=2.31.0 requests>=2.32.0
PyPDF2>=3.0.0 PyPDF2>=3.0.0
cryptography>=44.0.0