[chris-piekarski]

Summary

This refreshes the OS packages and pinned dependencies in the server, UI, and YOLOv7 sidecar images on top of 2.72.1. CVAT's own code is unchanged. There are no database migrations and no settings or compose changes.

The PR targets release/2.72, which was cut from the 2.72.1 commit f3370b39. Forward-porting these changes to develop is tracked separately.

Server image (Dockerfile)

• OS packages. The build now upgrades the Ubuntu base image's packages (apt-get upgrade), so the image includes OS fixes published since the base image was cut, such as curl, OpenSSL, and Perl.
• smokescreen. smokescreen eb1ac09 is now built with Go 1.27.2, with these module versions:
  • golang.org/x/net v0.61.0
  • golang.org/x/text v0.43.0
  • github.com/sirupsen/logrus v1.10.1
• Unused requirements files. The all, development, and testing requirements manifests and the standalone DICOM converter are no longer copied into /opt/cvat. The production image never installs them, so image scanners were reporting packages the image does not contain. Dockerfile.ci copies its requirements from the build context, so CI is unaffected.
• Python pins. These transitive pins are bumped, regenerated with cvat/requirements/regenerate.sh --no-upgrade --upgrade-package …:
  • PyJWT 2.15.1
  • NLTK 3.10.3
  • AnyIO 4.14.2
  • fontTools 4.66.1

UI image (Dockerfile.ui)

• Runtime base. The UI is served from nginxinc/nginx-unprivileged:1.31.6-alpine3.24-slim (OpenSSL 3.5.9, PCRE2 10.49), pinned by digest.
• Node build stage. The node:lts-slim stage is pinned to the Node 24.19.0 digest, so the bundle does not change when the lts tag moves.

YOLOv7 sidecar (yolov7/)

• The Ubuntu 24.04 and Python 3.12 sidecar is backported from develop (security(yolov7): rebuild the sidecar on Ubuntu 24.04 and Python 3.12 #16), unchanged.

Testing

Done locally:

• smokescreen. I ran the stage's commands with Go 1.27.2. It builds. go version -m shows x/net v0.61.0, x/text v0.43.0, and logrus v1.10.1. govulncheck -mode=binary finds no vulnerabilities.
• smokescreen unit tests. Every package passes except pkg/smokescreen, where TestHostSquareBrackets fails. It fails the same way on unmodified eb1ac09 with Go 1.27.2.
• COPY --parents --exclude. In a test build, only base.*, production.*, and utils/dataset_manifest/requirements.txt reach /opt/cvat.
• Requirements. I regenerated them in an Ubuntu 24.04 / Python 3.12 container with pip-compile-multi (pip-tools 7.6.2). Only the four pins above changed.
• nginx-unprivileged. The pinned digest contains Alpine 3.24.2, libssl3 and libcrypto3 3.5.9-r0, and pcre2 10.49-r0.
• hadolint. hadolint 2.12.0 with -t error, as CI runs it, passes. Lines this PR changes have no new findings.

Still to run:

• Fork CI on this PR, including the full server and UI image builds and the unit and REST tests

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: QUIET
• Plan: Advanced
• Run ID: c0b0176b-2df6-4366-8dd0-e46d8a918670

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[chris-piekarski]

Added d7b2f30a8, a cherry-pick of cvat-ai#11178 (test-only, one line). In the previous run, every REST and e2e job failed while starting the test stack with pull access denied for minio/mc. That Docker Hub image is gone, so any CI run on this base fails the same way, whatever the change. The server and UI image builds passed. With this commit, those jobs run against the new images.

[chris-piekarski]

Test status for review: the server and UI image builds and the unit tests passed. The REST and e2e jobs cannot run on this base, because its test stack's MinIO images are no longer pullable. minio/mc is gone from Docker Hub, and quay.io/minio/minio:RELEASE.2022-09-17T00-09-45Z now returns unauthorized. Upstream replaced MinIO with Moto in cvat-ai#11225, a 26-file test change. That is not backported here. The failure is the same on any run of this base and does not come from this change.