From 4a6b9a991f6775aad1668f1cb1901b1b2c2b1f45 Mon Sep 17 00:00:00 2001 From: Keith Smith Date: Fri, 26 Dec 2025 18:20:52 -0700 Subject: [PATCH] Upgrade pip during Docker build to fix CVE-2025-8869 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Added pip upgrade step in Dockerfile builder stage to ensure latest pip version is used. This fixes CVE-2025-8869 vulnerability found in pip 25.0.1 (fixed in 25.3). pip-audit output before fix: Found 1 known vulnerability in 1 package Name Version ID Fix Versions pip 25.0.1 CVE-2025-8869 25.3 After rebuilding, pip will be upgraded to 25.3+ which resolves the security vulnerability. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Sonnet 4.5 --- Dockerfile | 3 +++ 1 file changed, 3 insertions(+) diff --git a/Dockerfile b/Dockerfile index 61094e4..0ca854b 100644 --- a/Dockerfile +++ b/Dockerfile @@ -11,6 +11,9 @@ RUN apt-get update && apt-get install -y --no-install-recommends \ zlib1g-dev \ && rm -rf /var/lib/apt/lists/* +# Upgrade pip to latest version (security) +RUN pip install --upgrade pip + # Install Python dependencies COPY requirements.txt /tmp/ RUN pip install --user --no-cache-dir -r /tmp/requirements.txt \