From f7586f2a9379845c95c69daa11bc487459fc06cb Mon Sep 17 00:00:00 2001 From: Keith Smith Date: Fri, 26 Dec 2025 18:32:55 -0700 Subject: [PATCH] Fix pip upgrade to install in user directory MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Changed pip upgrade to use --user flag so the upgraded pip is installed to /root/.local and gets copied to the runtime stage. Previous version upgraded pip globally in builder stage but runtime stage was still using base image's pip (25.0.1). Now the upgraded pip is in .local/bin which is in the PATH in the runtime container. This fixes CVE-2025-8869 in pip. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Sonnet 4.5 --- Dockerfile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Dockerfile b/Dockerfile index 0ca854b..38fd721 100644 --- a/Dockerfile +++ b/Dockerfile @@ -11,8 +11,8 @@ RUN apt-get update && apt-get install -y --no-install-recommends \ zlib1g-dev \ && rm -rf /var/lib/apt/lists/* -# Upgrade pip to latest version (security) -RUN pip install --upgrade pip +# Upgrade pip to latest version (security) - install to user directory +RUN pip install --user --upgrade pip # Install Python dependencies COPY requirements.txt /tmp/