From aa9e1d51d91d6c30bb3a35a50905553ac9d3fc16 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Sun, 4 Oct 2026 20:11:38 +0000 Subject: [PATCH 1/4] Update dependency virtualenv to v21.14.5 --- test/requirements-tools.txt | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/test/requirements-tools.txt b/test/requirements-tools.txt index 3179b4f..10760c9 100644 --- a/test/requirements-tools.txt +++ b/test/requirements-tools.txt @@ -113,6 +113,6 @@ pyyaml==6.0.3 \ --hash=sha256:fa160448684b4e94d80416c0fa4aac48967a969efe22931448d853ada8baf926 \ --hash=sha256:fc09d0aa354569bc501d4e787133afc08552722d3ab34836a80547331bb5d4a0 -virtualenv==21.7.13 \ - --hash=sha256:0355558b6f33619aab31347e43643b0ebc97f61ea3acf617b2b69e1f8a843d11 \ - --hash=sha256:1bea5af7463f59c4719db48fe739579a2a4f569c96f26c086edda85c96da9f59 +virtualenv==21.14.5 \ + --hash=sha256:b0651e0174982bba17cc6f0aaa2ef496730cb85a3f35eb5d1119d1c904f7d1da \ + --hash=sha256:c4cb6c13e46b57225a999c7e22a09b163393878facc7ac4c059a57f46faa1647 From 62b774cafa9c46f0be5804ed491bf97c2158f986 Mon Sep 17 00:00:00 2001 From: Scott Gigawatt Date: Sun, 4 Oct 2026 16:15:37 -0400 Subject: [PATCH 2/4] =?UTF-8?q?=F0=9F=A7=A9=20Virtualenv=20brings=20its=20?= =?UTF-8?q?entire=20crew?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .github/renovate.json5 | 2 +- docs/container-scan-review.md | 2 +- test/requirements-tools.txt | 10 +++++++--- 3 files changed, 9 insertions(+), 5 deletions(-) diff --git a/.github/renovate.json5 b/.github/renovate.json5 index 20ac792..1a8a9a6 100644 --- a/.github/renovate.json5 +++ b/.github/renovate.json5 @@ -146,7 +146,7 @@ "description": "Respect virtualenv's filelock compatibility bound", "matchFileNames": ["test/requirements-tools.txt"], "matchDepNames": ["filelock"], - "allowedVersions": "<4" + "allowedVersions": "<5" }, { "matchDatasources": ["docker"], diff --git a/docs/container-scan-review.md b/docs/container-scan-review.md index 5507881..1954f0a 100644 --- a/docs/container-scan-review.md +++ b/docs/container-scan-review.md @@ -8,7 +8,7 @@ Buccaneerr uses Docker CLI 29.8.2 and Compose 5.6.0 from digest-pinned official The tool manifest locks CSpell, Pyright, and Markdownlint CLI2. Alpine's npm installs these checkers during the image build and is removed in the same layer, keeping its bundled dependencies out of the completed image. Pre-commit runs Markdownlint through the same Buccaneerr helper used for Python checks, so it does not install a separate Node environment. Removing npm also eliminates the bundled brace-expansion and http-cache-semantics vulnerabilities, including CVE-2026-102276, CVE-2026-102277, CVE-2026-102278, and CVE-2026-93748. Renovate maintains the checker lockfile using npm 11. -Pre-commit 4.6.2 and virtualenv 21.7.13 now install into `/opt/precommit` from `test/requirements-tools.txt`. Every dependency has an exact version and SHA-256 hashes, enforced with pip's `--require-hashes` mode. The bootstrap pip is removed after installation, keeping its older bundled libraries out of the completed image. This isolated test environment replaces Alpine's virtualenv 21.3.3, including four advisories reported by Scout: [CVE-2026-102925](https://github.com/advisories/GHSA-p58f-9548-mpm2), [CVE-2026-102930](https://github.com/advisories/GHSA-94p9-xgh2-xp45), [CVE-2026-102937](https://github.com/advisories/GHSA-x78j-v8h9-3j2q), and [CVE-2026-102938](https://github.com/advisories/GHSA-9h9j-4vrj-gf7g). These packages remain outside the production Privateerr image. +Pre-commit 4.6.2 and virtualenv 21.14.5 now install into `/opt/precommit` from `test/requirements-tools.txt`. Every dependency has an exact version and SHA-256 hashes, enforced with pip's `--require-hashes` mode. The bootstrap pip is removed after installation, keeping its older bundled libraries out of the completed image. This isolated test environment replaces Alpine's virtualenv 21.3.3, including four advisories reported by Scout: [CVE-2026-102925](https://github.com/advisories/GHSA-p58f-9548-mpm2), [CVE-2026-102930](https://github.com/advisories/GHSA-94p9-xgh2-xp45), [CVE-2026-102937](https://github.com/advisories/GHSA-x78j-v8h9-3j2q), and [CVE-2026-102938](https://github.com/advisories/GHSA-9h9j-4vrj-gf7g). These packages remain outside the production Privateerr image. Current `edge` images contain Python 3.14.8-r0; Buccaneerr also contains PCRE2 10.49-r0. These fix the Python and PCRE2 findings listed below. Alpine 3.24 stable now supplies nghttp2 1.70.0-r0 on all three platforms, so both images remove the old edge-package override. Buccaneerr still installs setuptools 83.0.0 or newer from edge because stable supplies 82.0.1-r1. Keep that remaining narrow exception until stable supplies the fixed version. diff --git a/test/requirements-tools.txt b/test/requirements-tools.txt index 10760c9..f285c1c 100644 --- a/test/requirements-tools.txt +++ b/test/requirements-tools.txt @@ -14,9 +14,9 @@ distlib==0.4.3 \ --hash=sha256:4b0ce306c966eb73bc3a7b6abad017c556dadd92c44701562cd528ac7fde4d5b \ --hash=sha256:f152097224a0ae24be5a0f6bae1b9359af82133bce63f98a95f86cae1aede9ed -filelock==3.32.7 \ - --hash=sha256:37b8a3d9811b0f9aef7e5ec5c71bb320de52df51e6ca9bcd6f5ad81187660da7 \ - --hash=sha256:65ff0d0190ea42038b32bda4b77834fb05be2cad4c5b9b01aa4dfb3614536e52 +filelock==4.0.10 \ + --hash=sha256:00d6a81f976a6332551c2c10f39e12b4abb7e01c64d4c497b81a615bc9186f1f \ + --hash=sha256:698048d158dc3c9e18cc5e88b3efdd4bd0e77d76686b22adb4511cc4b2c2f0db identify==2.6.20 \ --hash=sha256:6a16b69b93187244e0548cbfd25b3e4a6f9a7a2ad784625c3bec2b8d27b81aaa \ @@ -26,6 +26,10 @@ nodeenv==1.11.0 \ --hash=sha256:3ce8fe5b71d16e8af7039ca65257354100bc772965d6bc549070649e53b1b146 \ --hash=sha256:edaa16e6c14d7cf395d75d4bbd5a26390f4dc06501a33b4e76282b02cc688a25 +packaging==26.3 \ + --hash=sha256:94edc256424af38762eb31306eed28beb9f0efc50a8837492c9d6fd6004aed79 \ + --hash=sha256:d7193f7c8e4e93f444fde0262bf90af30e16fa0ad0ad44cb553c87339b23cd1c + platformdirs==4.12.3 \ --hash=sha256:080f3b39423b5abfca9a23d84c4e9795f54d395cd8459867a8ded44084fcd5f8 \ --hash=sha256:427fc0bb321ae0c5b037fa03238ca74820437be162e78b4848c4d4055b9b766c From efac03c305f7a7bc6f58ca7e3accf0946e10d190 Mon Sep 17 00:00:00 2001 From: Scott Gigawatt Date: Sun, 4 Oct 2026 16:29:07 -0400 Subject: [PATCH 3/4] =?UTF-8?q?=F0=9F=A7=B9=20Evict=20the=20phantom=20Pyth?= =?UTF-8?q?on=203.9=20stowaways?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .vscode/settings.json | 1 + docs/container-scan-review.md | 16 ++++++++++++++-- test/Dockerfile | 2 ++ 3 files changed, 17 insertions(+), 2 deletions(-) diff --git a/.vscode/settings.json b/.vscode/settings.json index a49f3e3..4345f3b 100644 --- a/.vscode/settings.json +++ b/.vscode/settings.json @@ -152,6 +152,7 @@ "SERVERLIST", "setitimer", "setsid", + "sboms", "setuptools", "shellcheck", "SIGALRM", diff --git a/docs/container-scan-review.md b/docs/container-scan-review.md index 1954f0a..d5cc7b8 100644 --- a/docs/container-scan-review.md +++ b/docs/container-scan-review.md @@ -8,13 +8,13 @@ Buccaneerr uses Docker CLI 29.8.2 and Compose 5.6.0 from digest-pinned official The tool manifest locks CSpell, Pyright, and Markdownlint CLI2. Alpine's npm installs these checkers during the image build and is removed in the same layer, keeping its bundled dependencies out of the completed image. Pre-commit runs Markdownlint through the same Buccaneerr helper used for Python checks, so it does not install a separate Node environment. Removing npm also eliminates the bundled brace-expansion and http-cache-semantics vulnerabilities, including CVE-2026-102276, CVE-2026-102277, CVE-2026-102278, and CVE-2026-93748. Renovate maintains the checker lockfile using npm 11. -Pre-commit 4.6.2 and virtualenv 21.14.5 now install into `/opt/precommit` from `test/requirements-tools.txt`. Every dependency has an exact version and SHA-256 hashes, enforced with pip's `--require-hashes` mode. The bootstrap pip is removed after installation, keeping its older bundled libraries out of the completed image. This isolated test environment replaces Alpine's virtualenv 21.3.3, including four advisories reported by Scout: [CVE-2026-102925](https://github.com/advisories/GHSA-p58f-9548-mpm2), [CVE-2026-102930](https://github.com/advisories/GHSA-94p9-xgh2-xp45), [CVE-2026-102937](https://github.com/advisories/GHSA-x78j-v8h9-3j2q), and [CVE-2026-102938](https://github.com/advisories/GHSA-9h9j-4vrj-gf7g). These packages remain outside the production Privateerr image. +Pre-commit 4.6.2 and virtualenv 21.14.5 now install into `/opt/precommit` from `test/requirements-tools.txt`. Every dependency has an exact version and SHA-256 hashes, enforced with pip's `--require-hashes` mode. The bootstrap pip is removed after installation. The image also removes virtualenv's unused Python 3.9 seed wheels, retaining the exact upstream pip 26.2.1 and setuptools 84.0.0 wheels for the installed Python 3.14 and their SHA-256 verification. This isolated test environment replaces Alpine's virtualenv 21.3.3, including four advisories reported by Scout: [CVE-2026-102925](https://github.com/advisories/GHSA-p58f-9548-mpm2), [CVE-2026-102930](https://github.com/advisories/GHSA-94p9-xgh2-xp45), [CVE-2026-102937](https://github.com/advisories/GHSA-x78j-v8h9-3j2q), and [CVE-2026-102938](https://github.com/advisories/GHSA-9h9j-4vrj-gf7g). These packages remain outside the production Privateerr image. Current `edge` images contain Python 3.14.8-r0; Buccaneerr also contains PCRE2 10.49-r0. These fix the Python and PCRE2 findings listed below. Alpine 3.24 stable now supplies nghttp2 1.70.0-r0 on all three platforms, so both images remove the old edge-package override. Buccaneerr still installs setuptools 83.0.0 or newer from edge because stable supplies 82.0.1-r1. Keep that remaining narrow exception until stable supplies the fixed version. ## Remaining package-level alerts -Privateerr `edge` has no findings in either scanner across all three platforms. Before the virtualenv update, Buccaneerr `edge` has two unique Trivy findings and nine unique Scout findings; the four virtualenv findings have published fixes and are addressed by this change. The rebuilt ARM64 image has two unique Trivy findings and five unique Scout findings, with all four virtualenv advisories removed. The remaining package-level reports require the following context. No scanner exclusion hides them. +Privateerr `edge` has no findings in either scanner across all three platforms. Before the virtualenv update, Buccaneerr `edge` has two unique Trivy findings and nine unique Scout findings; the four virtualenv findings have published fixes and are addressed by this change. The rebuilt image has two unique Trivy findings and twenty-four unique Scout identifiers, with all four virtualenv advisories removed. Virtualenv 21.14.5 adds an upstream package SBOM describing every original seed wheel, so Scout now reports bundled dependencies that the earlier review did not enumerate. Twelve identifiers concern retained packages or their metadata; twelve additional identifiers describe removed Python 3.9 seed assets in that upstream build inventory. The inventory remains unchanged and the removed files are verified absent from the completed image. The remaining package-level reports require the following context. No scanner exclusion hides them. - **CVE-2026-93687:** [braces 3.0.3](https://github.com/advisories/GHSA-vfj7-8cjw-p6xm) has a stack-exhaustion issue in deeply nested patterns and no published patched version. Markdownlint CLI2 depends on it through micromatch. Keep the GitHub dependency alert visible and use repository-controlled file patterns for checks. - **GO-2026-5932:** The Go [advisory](https://pkg.go.dev/vuln/GO-2026-5932) concerns the unmaintained OpenPGP package. Compose's module metadata includes `golang.org/x/crypto`; the advisory does not apply to every package in that module. @@ -22,6 +22,18 @@ Privateerr `edge` has no findings in either scanner across all three platforms. - **CVE-2026-39824:** The Go [advisory](https://pkg.go.dev/vuln/GO-2026-5024) affects a Windows string conversion in `golang.org/x/sys/windows`. Buccaneerr runs the Linux actionlint binary, whose module metadata still includes the older version. - **CVE-2026-84445:** The gRPC [advisory](https://github.com/grpc/grpc-go/security/advisories/GHSA-2v4p-qf9q-27wj) affects servers configured with `xds.NewGRPCServer()`. Scout reports gRPC 1.84.0 in the Docker client, but the current upstream advisory lists 1.84.0 as patched. Buccaneerr also starts no xDS server; review the separate Docker host independently. +## Bundled installer findings + +Virtualenv needs its integrity-checked pip seed wheel to create fresh Python hook environments. The current published pip release, 26.2.1, still vendors the dependencies below. Installing their standalone fixed releases does not replace code inside that wheel. The [upstream vendoring policy](https://pip.pypa.io/en/latest/development/vendoring-policy/) does not support replacing individual bundled libraries; this image preserves the upstream wheel rather than maintaining a custom pip distribution. There is no published pip release containing these dependency fixes as of this review. These findings remain visible in Scout and require an upstream pip update. They affect the test-only Buccaneerr seed installer; production Privateerr contains neither virtualenv nor pip. + +| Bundled dependency | Reported advisory | Standalone fixed version | +| --- | --- | --- | +| msgpack 1.1.2 | [CVE-2026-57585](https://github.com/advisories/GHSA-6v7p-g79w-8964) | 1.2.1 | +| urllib3 2.7.0 | [CVE-2026-97687](https://www.cve.org/CVERecord?id=CVE-2026-97687), [CVE-2026-97688](https://www.cve.org/CVERecord?id=CVE-2026-97688), [CVE-2026-97689](https://www.cve.org/CVERecord?id=CVE-2026-97689) | 2.8.0 | +| setuptools 70.3.0, limited to pip's vendored `pkg_resources` | [CVE-2025-47273](https://www.cve.org/CVERecord?id=CVE-2025-47273), [CVE-2026-59890](https://www.cve.org/CVERecord?id=CVE-2026-59890) | 78.1.1 and 83.0.0, respectively | + +The unused pip 26.0.1 and setuptools 82.0.1 seed wheels target Python 3.9, which this image does not provide. Removing those assets removes their vulnerable code without changing the active Python 3.14 seed wheels. Scout still reports the removed assets from virtualenv's original package SBOM at `virtualenv-21.14.5.dist-info/sboms/virtualenv.cdx.json`; that upstream inventory describes the unmodified distributed wheel, not the image after pruning. Keep this distinction visible when reviewing the scan. A fresh pre-commit Python hook environment verifies that environment creation and package installation still work. + A successful workflow scan rejects fixed high or critical findings; it does not mean either scanner reports zero findings. CI uses `ignore-unfixed: true` and scans its local build. Use the full artifact scans above when evaluating other severities, unfixed dependencies, platforms, and published stable images. ## Stable image refresh diff --git a/test/Dockerfile b/test/Dockerfile index a7c357b..86e9778 100644 --- a/test/Dockerfile +++ b/test/Dockerfile @@ -99,11 +99,13 @@ RUN apk upgrade --no-cache libcrypto3 libssl3 && \ # Install pre-commit with fixed virtualenv outside Alpine's older Python tool packages. # The complete lockfile verifies every dependency and keeps these tools test-only. +# Keep only seed wheels for the installed Python, preserving their upstream hash checks. COPY test/requirements-tools.txt /tmp/requirements-tools.txt RUN python3 -m venv /opt/precommit && \ /opt/precommit/bin/python -m pip install --no-cache-dir --disable-pip-version-check \ --require-hashes --requirement /tmp/requirements-tools.txt && \ /opt/precommit/bin/python -m pip uninstall --yes pip && \ + /opt/precommit/bin/python -c 'import sys; from virtualenv.seed.wheels import embed; version = ".".join(map(str, sys.version_info[:2])); active = embed.BUNDLE_SUPPORT[version]; [embed.get_embed_wheel(package, version) for package in active]; [wheel.unlink() for wheel in embed.BUNDLE_FOLDER.glob("*.whl") if wheel.name not in active.values()]' && \ apk del py3-pip && \ rm /tmp/requirements-tools.txt ENV PATH="/opt/precommit/bin:${PATH}" From 4008ebbdc2c7fc893fb6aa19e7cc780f841b2104 Mon Sep 17 00:00:00 2001 From: Scott Gigawatt Date: Sun, 4 Oct 2026 16:29:56 -0400 Subject: [PATCH 4/4] =?UTF-8?q?=F0=9F=93=9C=20Pip=20gets=20an=20honest=20p?= =?UTF-8?q?assenger=20manifest?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- docs/container-scan-review.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/container-scan-review.md b/docs/container-scan-review.md index d5cc7b8..09b1e5e 100644 --- a/docs/container-scan-review.md +++ b/docs/container-scan-review.md @@ -24,7 +24,7 @@ Privateerr `edge` has no findings in either scanner across all three platforms. ## Bundled installer findings -Virtualenv needs its integrity-checked pip seed wheel to create fresh Python hook environments. The current published pip release, 26.2.1, still vendors the dependencies below. Installing their standalone fixed releases does not replace code inside that wheel. The [upstream vendoring policy](https://pip.pypa.io/en/latest/development/vendoring-policy/) does not support replacing individual bundled libraries; this image preserves the upstream wheel rather than maintaining a custom pip distribution. There is no published pip release containing these dependency fixes as of this review. These findings remain visible in Scout and require an upstream pip update. They affect the test-only Buccaneerr seed installer; production Privateerr contains neither virtualenv nor pip. +Virtualenv needs its integrity-checked pip seed wheel to create fresh Python hook environments. The current published pip release, 26.2.1, still vendors the dependencies below. Installing their standalone fixed releases does not replace code inside that wheel. The [upstream vendoring policy](https://pip.pypa.io/en/latest/development/vendoring-policy/) does not support partially removing bundled libraries. Updating their vendored versions would require maintaining and validating a custom pip distribution, so this image preserves the upstream wheel. There is no published pip release containing these dependency fixes as of this review. These findings remain visible in Scout and require an upstream pip update. They affect the test-only Buccaneerr seed installer; production Privateerr contains neither virtualenv nor pip. | Bundled dependency | Reported advisory | Standalone fixed version | | --- | --- | --- |