From 546eb48986090aaffc8f71b6d1b641245ea7d351 Mon Sep 17 00:00:00 2001 From: Eddie Tejeda <669988+eddietejeda@users.noreply.github.com> Date: Wed, 28 Oct 2026 10:33:27 -0700 Subject: [PATCH] Floor duckdb to 1.4.2 so a build cannot land on CVE-2025-64429 Nothing in the dependency graph asks for duckdb -- not hotdata, not hotdata-langchain -- so the unpinned install was whatever PyPI served the day the layer was built, and 1.4.0-1.4.1 were current long enough to be baked into a published image. Those skip the return code of OpenSSL's rand_bytes() in the encryption path added in 1.4.0, so a failed generator reads as a good one; 1.4.2 checks it. The server only casts JSONL to parquet over an in-memory connection and never attaches an encrypted database, so the path was unreachable here -- this keeps the scanner's finding from coming back, it does not close an incident. A floor, not a pin, and alongside urllib3's for the same reason: a rebuild today already resolves past it, but a layer cache or a platform without current wheels would quietly drop back. Same floor in the local-dev install line, so a fresh venv cannot reproduce it either. --- Dockerfile | 14 ++++++++++---- docs/operating.md | 2 +- 2 files changed, 11 insertions(+), 5 deletions(-) diff --git a/Dockerfile b/Dockerfile index 41315a8..3b3e8b3 100644 --- a/Dockerfile +++ b/Dockerfile @@ -3,16 +3,22 @@ FROM python:3.12-slim # The base tag lags Debian security updates, so upgrade in place rather than # ship whatever it last froze. urllib3 is floored because `pip install -# hotdata` accepts versions with known CVEs. pip is removed once it has done -# its job: nothing at runtime needs it, and its vendored copies of msgpack and -# setuptools are scanner findings of their own. +# hotdata` accepts versions with known CVEs. duckdb is floored for the same +# reason and against nothing: no dependency here asks for it, so an unpinned +# `duckdb` is whatever PyPI served the day the layer was built, and 1.4.0-1.4.1 +# were current long enough to be baked in. Those carry CVE-2025-64429, where +# the encryption path skips the return code of OpenSSL's rand_bytes() and +# cannot tell a failed generator from a good one; 1.4.2 checks it. The floor, +# not a pin, so the build keeps taking later releases. +# pip is removed once it has done its job: nothing at runtime needs it, and its +# vendored copies of msgpack and setuptools are scanner findings of their own. # hotdata-langchain[agents] + langchain-anthropic/openai back the Insights # page; the server boots without them (the page says it is off), but the # image carries them so an operator only has to set the model env vars. RUN apt-get update && \ apt-get upgrade -y --no-install-recommends && \ rm -rf /var/lib/apt/lists/* && \ - pip install --no-cache-dir hotdata duckdb 'urllib3>=2.8.0' \ + pip install --no-cache-dir hotdata 'duckdb>=1.4.2' 'urllib3>=2.8.0' \ "hotdata-langchain[agents]" langchain-anthropic langchain-openai && \ pip uninstall -y pip && \ useradd --create-home --uid 10001 appuser diff --git a/docs/operating.md b/docs/operating.md index 84396d2..a6a2a0c 100644 --- a/docs/operating.md +++ b/docs/operating.md @@ -16,7 +16,7 @@ isolated rather than filtered out of a shared table. ## Running it ```bash -uv venv && uv pip install hotdata duckdb +uv venv && uv pip install hotdata 'duckdb>=1.4.2' export HOTDATA_API_KEY= # or ~/.hotdata/hotdata.json export HOTUSAGE_INGEST_TOKEN= # unset = dev mode (accepts all) .venv/bin/python server/server.py --host 0.0.0.0 --port 8377