From 7561d561c1be599e4c53ccbb64e7cb931862b9ab Mon Sep 17 00:00:00 2001 From: Robert van 't Hof Date: Wed, 16 Sep 2026 10:03:05 +0100 Subject: [PATCH 1/3] Fix Bandit annotation for deployment history pruning --- Controller/app/deploy_history.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Controller/app/deploy_history.py b/Controller/app/deploy_history.py index b21546c..9a024c7 100644 --- a/Controller/app/deploy_history.py +++ b/Controller/app/deploy_history.py @@ -105,7 +105,7 @@ def record(app_name: str, operation: str, record: AppRecord, status: str, def _prune(app_name: str) -> None: """Keep only the newest _KEEP_PER_APP rows for this app.""" - # nosec B608 - _TABLE is a fixed constant and _KEEP_PER_APP an int literal; + # _TABLE comes from deployment configuration and _KEEP_PER_APP is an int literal; # app_name is parameterized (bound twice, once per subquery reference). sf.execute_sql( f""" @@ -117,7 +117,7 @@ def _prune(app_name: str) -> None: ORDER BY ts DESC, id DESC LIMIT {_KEEP_PER_APP} ) - """, + """, # nosec B608 (app_name, app_name), ) From 22da3b9ab1b9b88b10c01bac22a90cd76e3bd67a Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 16 Sep 2026 09:06:24 +0000 Subject: [PATCH 2/3] Bump streamlit from 1.58.0 to 1.63.0 in /Admin UI Bumps [streamlit](https://github.com/streamlit/streamlit) from 1.58.0 to 1.63.0. - [Release notes](https://github.com/streamlit/streamlit/releases) - [Commits](https://github.com/streamlit/streamlit/compare/1.58.0...1.63.0) --- updated-dependencies: - dependency-name: streamlit dependency-version: 1.63.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] --- Admin UI/requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Admin UI/requirements.txt b/Admin UI/requirements.txt index 11ec09d..c03e723 100644 --- a/Admin UI/requirements.txt +++ b/Admin UI/requirements.txt @@ -1,3 +1,3 @@ -streamlit==1.58.0 +streamlit==1.63.0 httpx==0.28.1 snowflake-connector-python==4.7.3 From 374dfcbf2fa0c9ee636d9be1c7a0fc626f704dc9 Mon Sep 17 00:00:00 2001 From: Robert van 't Hof Date: Wed, 16 Sep 2026 10:10:56 +0100 Subject: [PATCH 3/3] Refresh service runtime images for OpenSSL security fix --- Admin UI/Dockerfile | 2 +- Controller/Dockerfile | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/Admin UI/Dockerfile b/Admin UI/Dockerfile index 4cb5f75..4918beb 100644 --- a/Admin UI/Dockerfile +++ b/Admin UI/Dockerfile @@ -42,7 +42,7 @@ RUN mkdir -p /opt/runtime-libs \ # GLIBC_2.38 symbols libpython3.12.so needs. # NOTE: no RUN is possible in this stage (no shell). Anything needing mkdir/ # chown at build time goes in the builder stage above. -FROM gcr.io/distroless/cc-debian13:nonroot@sha256:aded2458d026e046cb68199db0e5793e1028ffa143f7258f3c4278253e20add7 +FROM gcr.io/distroless/cc-debian13:nonroot@sha256:54df941ed0d06a1bd95ef5e0ce391fd8d9f94b64782dc9a60062727849ee3f97 # /usr/local carries the interpreter, stdlib C extensions (lib-dynload), # libpython3.12.so, and all pip-installed packages in one consistent copy. COPY --from=builder --chown=65532:65532 /usr/local /usr/local diff --git a/Controller/Dockerfile b/Controller/Dockerfile index 52beba0..18c63d2 100644 --- a/Controller/Dockerfile +++ b/Controller/Dockerfile @@ -41,7 +41,7 @@ RUN mkdir -p /opt/runtime-libs \ # 2.36 predates the GLIBC_2.38 symbols libpython3.12.so needs. # NOTE: no RUN is possible in this stage (no shell). Anything needing mkdir/ # chown at build time goes in the builder stage above. -FROM gcr.io/distroless/cc-debian13:nonroot@sha256:aded2458d026e046cb68199db0e5793e1028ffa143f7258f3c4278253e20add7 +FROM gcr.io/distroless/cc-debian13:nonroot@sha256:54df941ed0d06a1bd95ef5e0ce391fd8d9f94b64782dc9a60062727849ee3f97 # /usr/local carries the interpreter, stdlib C extensions (lib-dynload), # libpython3.12.so, and all pip-installed packages in one consistent copy. COPY --from=builder --chown=65532:65532 /usr/local /usr/local