[groupthinking]

fix(security): clear the fixable runtime-image findings (zlib1g, pip-vendored setuptools)

Refs #2396 (partial; parent stays open). Linear: GRV-807.

Baseline evidence

• Security Scan run 43343802638, push to main at 512a2558f73d6281b6a880548bedf140b7e30292 (PR fix(security): refresh runtime npm's bundled undici #2645 merge). trivy job 131618182805 concluded success because the job uses exit-code: '0'.
• Artifact trivy-image-evidence 14000154856, ZIP SHA-256 631a3072ccdc7a0a3591b53deecc58cda06773627d0458c69c97c1a866cffdfc. image-source-commit.txt = 512a2558f…. Image ID sha256:99a1cbcdbe9294c508649c5dea491e20242937d9374e774c3ae37bb02992eaa5 (local build, linux/amd64). Base python:3.11-slim@sha256:07d4824036af339fa1b6ef769cc99d9c10a141769538b52b3b597c84f7a7b535 (Debian 13 trixie). Trivy 0.70.0.
• Independent SARIF parse: 316 HIGH/CRITICAL occurrences (77 unique advisories):

Source	Severity	Fixed version reported	Occurrences
OS / Debian	CRITICAL	none	1 (libxml2 CVE-2026-6653)
OS / Debian	HIGH	none	312
OS / Debian	HIGH	yes	2 (zlib1g CVE-2026-76844, CVE-2026-85091)
Python library	HIGH	yes	1 (setuptools 70.3.0 CVE-2025-47273, fix 78.1.1)
Global npm / app node_modules	—	—	0

The global npm (brace-expansion, http-cache-semantics, undici) and pip-vendored msgpack/urllib3 findings from the October baseline are absent from this report.

Changes (two commits, separately revertible)

1. apt-get upgrade in the runtime stage before installing runtime packages. The base layer ships zlib1g 1:1.3.dfsg+really1.3.1-1+b1; the Debian tracker lists both CVEs fixed in trixie-security 1:1.3.dfsg+really1.3.1-1+deb13u1 (DSA-6613-1). The .deb is present in the security.debian.org pool. The build log already shows 1 not upgraded.
   • Runtime behavior: patch-level Debian security updates only, with no dist-upgrade. The image is still not reproducible to the byte, because upgrades follow the archive on the day it builds; that was already true of the unpinned apt-get install lines.
2. pip uninstall --yes pip in the runtime stage after COPY --from=builder /usr/local/bin. pip 26.3 (newest on PyPI, wheel sha256 f3b60b20…fad13) ships pip/_vendor/bom.cdx.json declaring setuptools 70.3.0 (its vendored pkg_resources). That record is the CVE-2025-47273 hit; site-packages setuptools is already 84.2.1. No pip upgrade clears it.
   • Runtime behavior: the served app (uvicorn youtube_extension.main:app) does not import or invoke pip. Only the developer CLI youtube-extension install shells out to python -m pip, and that is not a runtime path in this image. Anyone debugging in a running container can no longer pip install (use python -m ensurepip if needed).
   • Checked locally: uninstalling pip 26.3 from a venv removes the pip* scripts and bom.cdx.json, and the interpreter still runs.

Policy tests were added to tests/unit/test_merge_policy_security_scan_wording.py: upgrade precedes install with no dist-upgrade, and pip is removed after the builder copy, before USER, with no later pip install. Each new test fails against 512a2558 and passes with its change.

Expected effect: UNVERIFIED until this PR's Trivy run

316 → 313 expected (−2 zlib1g, −1 setuptools), leaving no finding with a reported fix. Not a clean image: 313 Debian occurrences with no fixed version remain. Main groups: ffmpeg/libav* 153, krb5 56, util-linux 36, Debian python3.13 pulled by nodesource nodejs 20, gnupg 7, curl 4, libxml2 8 (one CRITICAL), others 29.

Verification

• pytest -o addopts="" tests/unit/test_merge_policy_security_scan_wording.py tests/unit/test_node_engines_floor.py tests/unit/test_dependency_review_workflow.py: 89 passed.
• ruff check / ruff format --check on the changed test file: clean. git diff --check: clean.
• Not run locally: image build and Trivy rescan (sandbox memory and disk limits). The PR's own Security Scan run must provide the exact image, source and SARIF readback.

Not in scope (follow-ups)

• Making the gate honest: ignore-unfixed: true + exit-code: '1' for fixable HIGH/CRITICAL in one scan step, keeping the full SARIF step at exit-code: '0'. This needs MERGE_POLICY.md and policy-test updates, and it would be green only after this PR lands.
• Shrinking the unfixed Debian surface. ffmpeg alone accounts for 153 occurrences. gnupg/curl are only needed at build time for the nodesource script and could move out of runtime via a Node binary copy or keyring. python3.13 comes in as a nodesource nodejs dependency.
• Dependency Review NumPy 2.5.4 composite-license failure: not re-checked here.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
v0-uvai	Ready	Preview, v0	Nov 13, 2026 9:54am UTC

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None