[chris-piekarski]

Summary

This bumps eight pinned Python dependencies in the server image, removes the Python venv tooling from the server's runtime stage, and has the UI image upgrade its Alpine packages at build time. It builds on release/2.72 (2.72.1 plus #18). CVAT's own code is unchanged. There are no database migrations and no settings or compose changes.

Upstream develop already pins Django 5.2.18, cryptography 50.0.1, lxml 6.1.3, sqlparse 0.6.0, urllib3 2.8.0 and pyasn1 0.6.4. The two Dockerfile changes are not on develop; forward-porting them is left to a follow-up.

Server image: Python pins (cvat/requirements/base.in, base.txt)

Regenerated with cvat/requirements/regenerate.sh --no-upgrade --upgrade-package …. Only these pins change:

Package	From	To
Django	5.2.14	5.2.18
cryptography	49.0.0	50.0.1
lxml	5.4.0	6.1.3
sqlparse	0.5.3	0.6.0
urllib3	2.7.0	2.8.0
idna	3.10	3.15
pyasn1	0.6.3	0.6.4
djangorestframework	3.17.1	3.17.2

base.in now allows lxml 6 (lxml>=6.1.3,<7), as develop does. Datumaro's pinned commit is the same on both branches. oauthlib stays on 3.x: 4.0 is a major release, and develop has not moved to it.

Server image: runtime stage (Dockerfile)

After the venv is built and pip is uninstalled from it, the runtime stage purges python3-venv, python3.12-venv, python3-pip-whl and python3-setuptools-whl. Nothing uses them at runtime, and image scanners report the bundled pip wheel as the OS python-pip package.

UI image (Dockerfile.ui)

The pinned nginx-unprivileged:1.31.6-alpine3.24-slim base still ships zlib 1.3.2-r0, and Alpine 3.24 now has 1.3.2-r1. The runtime stage runs apk upgrade --no-cache as root, as the server image already upgrades its Ubuntu packages, then switches back to uid 101, the base image's unprivileged user.

YOLOv7 sidecar

No change. Its apt packages are unpinned, so rebuilding it picks up the current Ubuntu 24.04 packages, including libx11 2:1.8.7-1ubuntu0.1.

Testing

Done locally:

• Requirements. Regenerated in an Ubuntu 24.04 / Python 3.12 container with pip-compile-multi (pip-tools 7.6.2). Only the eight pins above changed.
• Known vulnerabilities. OSV lists none for any of the eight new versions. It lists ten CVEs for Django 5.2.14; 5.2.18 has none.
• Server image build. docker build . succeeds. The purge step removes exactly python3-pip-whl, python3-setuptools-whl, python3-venv and python3.12-venv, and nothing else.
• Server image contents. The venv has the eight new versions; oauthlib (3.3.1) and NLTK (3.10.3) are unchanged. lxml and xmlsec both use libxml2 2.9.14, so import xmlsec raises no version mismatch. PyAV 16.0.1 loads the bundled FFmpeg 8.0. pip, /usr/share/python-wheels and the four purged packages are absent, and the image still runs as django (uid 1000).
• Django. In the image, manage.py check reports no issues, and manage.py makemigrations --check --dry-run reports no changes, so the Django bump needs no migrations.
• Trivy. Trivy 0.75.0 (vulnerability DB of 2026-10-14) finds one High or Critical in the server image: NLTK CVE-2026-81726, which has no fixed release yet.
• UI runtime stage. Built on its own with the real react_nginx.conf: zlib is 1.3.2-r1, every nginx process runs as uid 101, and /, /robots.txt and an SPA route return 200.
• hadolint. hadolint 2.12.0 with -t error, as CI runs it, passes. The new server RUN adds one info-level DL3059 (consecutive RUNs); it stays separate so upstream's pip-uninstall line is untouched. The UI change adds no findings.

Still to run:

• Fork CI on this PR, including the full server and UI image builds and the unit tests. As on security(images): refresh OS packages and pinned dependencies in the runtime images #18, the REST and e2e jobs cannot start their test stack on this base, because its MinIO images are no longer pullable.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Pe4wMaSPgK3pcbbsShPjqz

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: QUIET
• Plan: Advanced
• Run ID: a45283f6-d85d-4a7f-8113-540c96e315c6

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: QUIET
• Plan: Advanced
• Run ID: 04b065fb-7c46-4d4e-ad1a-6edf1d1d681b

📥 Commits

Reviewing files that changed from the base of the PR and between 5106cde and b3cb26a.

📒 Files selected for processing: 5

• Dockerfile
• Dockerfile.ui
• changelog.d/20261014_201417_lux_image_dependency_update.md
• cvat/requirements/base.in
• cvat/requirements/base.txt

Included review availability: This review used your included allowance. 2 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 4 reviews per hour.

⏰ Context from checks skipped due to timeout: 4

• GitHub Check: build
• GitHub Check: remark
• GitHub Check: eslint
• GitHub Check: typescript

🔇 Additional comments: 6

cvat/requirements/base.in: 1

31-31: LGTM!

cvat/requirements/base.txt: 2

1-1: LGTM!

Also applies to: 68-68, 103-103, 139-139, 169-169, 227-227, 321-321, 340-340

49-49: 🔒 Security & Privacy | 🛡️ Detected with Advanced Tier

The available evidence does not establish a CVAT code path that reaches the affected X.509 operation.

Dockerfile: 1

194-200: LGTM!

changelog.d/20261014_201417_lux_image_dependency_update.md: 1

1-8: LGTM!

Dockerfile.ui: 1

41-45: LGTM!

📝 Summary

🎯 Executive Summary

This PR updates pinned Python dependencies, removes unused virtual-environment tooling from the server runtime image, and upgrades Alpine packages in the UI image. It changes image build contents without changing CVAT application code, database migrations, settings, or Compose files.

📝 Release Notes

• Security: Upgrade Django, cryptography, lxml, sqlparse, urllib3, idna, pyasn1, and Django REST framework.
• Refactoring: Remove python3-venv, python3.12-venv, python3-pip-whl, and python3-setuptools-whl from the server runtime image after creating the virtual environment.
• Security: Upgrade Alpine packages in the UI image, then restore the image build to user 101.

📊 Contribution Statistics

Contributing Author	Lines Added (+)	Lines Removed (-)	Total Files Modified
Not provided	32	10	5

🗺️ Architectural Flow

No complex architectural changes detected.

🔍 Technical Details & Impact

• Key Files Modified:
  • Dockerfile: Purges virtual-environment tooling from the server runtime image after virtual-environment setup.
  • Dockerfile.ui: Upgrades Alpine packages as root, then switches to user 101.
  • cvat/requirements/base.in and cvat/requirements/base.txt: Update the lxml constraint and pinned dependency versions.
  • changelog.d/20261014_201417_lux_image_dependency_update.md: Documents the image and dependency updates.
• Breaking Changes: None. No database migrations or removed APIs are reported.
• Security & Performance: Dependency pins and Alpine packages are updated, and unused runtime tooling is removed. The author reports local success for docker build ., manage.py check, and manage.py makemigrations --check --dry-run. The author also reports one High or Critical finding in the server image, NLTK CVE-2026-81726, with no fixed release available. Fork CI, including full server and UI image builds and unit tests, remains pending. REST and end-to-end jobs reportedly cannot start because the base branch's MinIO images are no longer pullable.

The server image updates Python dependency pins and removes selected virtual-environment packages and bundled wheels after environment setup. The UI image upgrades Alpine packages and switches to user 101.

Changes: Image and dependency updates

Layer / File(s)	Summary
Server Python dependencies and image packages cvat/requirements/base.in, cvat/requirements/base.txt, Dockerfile, changelog.d/20261014_201417_lux_image_dependency_update.md	The lxml constraint and eight pinned dependencies are updated. The server image purges selected virtual-environment packages and bundled wheels after environment setup. The changelog records the dependency and image updates.
UI image package upgrade Dockerfile.ui	The image runs apk upgrade --no-cache as root, then switches to user 101.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Other

Suggested reviewers: speclad

Merge Risk: ⚪ Minimal · up to b3cb2

No actionable image or dependency failure is established: the generated requirements hash is valid, the purge removes venv-creation support, and the inspected UI configuration shows no non-root startup conflict.

Security architecture risk: 🔵 Low · up to b3cb2

The changes are confined to server dependencies and container-image packaging, with no demonstrated expansion of runtime privileges. A certificate-processing question remains unresolved, so the assessment is not minimal.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• observed — The upgraded cryptography dependency remains attributed to azure-storage-blob, datumaro, and pyjwt in both base and head. This identifies dependency consumers, not attacker-reachable certificate-processing paths.

Security Findings and Attack Paths

• observed — The supplied security assessment retains no verified findings and defers the certificate-concurrency candidate. Neither attacker-controlled certificate ingress nor concurrent extension access on one shared X.509 object has been established. The dependency pin alone does not prove that attack path or that the upgrade worsens exposure.

Trust Boundaries and Controls

• observed — The UI grants root authority to the build-time Alpine upgrade and then explicitly selects UID 101. The server still selects UID/GID 1000:1000 before its runtime entrypoint. The inspected Dockerfile changes do not add runtime root authority.

Pre-merge checks: 5

Passed checks: 5 passed

Check name	Status	Explanation
Title check		The title clearly and specifically summarizes the main changes: updating server Python dependencies, removing unused virtual-environment tooling, and upgrading UI Alpine packages.
Description check		The description is directly related to the changeset and provides detailed context about dependency updates, Dockerfile changes, testing, and remaining CI work.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches: 💡 1

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

🛠️ Fix failing CI checks: 💡

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{The server sheds wheels from its load,
Fresh pins roll down the dependency road.
Alpine gets an upgrade pass,
Then user 101 takes the helm at last.
The build train steams on, less cluttered than before.}

_{Comment @coderabbitai help to get the list of available commands.}

[chris-piekarski]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[chris-piekarski]

unit_testing failed on the first run, and this PR caused it. Dockerfile.ci builds on the server image and runs python3 -m ensurepip. That failed with No module named ensurepip, because the server image now removes python3-venv once its venv is built. 2acc731fa reinstalls python3-venv in the CI image only, and the production image stays without it. Built locally from this branch's server image, the CI image now gets pip 24.0 from ensurepip and installs testing.txt.

As on #18, the REST and e2e jobs cannot start their test stack on this base, because its MinIO images are no longer pullable. The server and UI image builds passed.

[chris-piekarski]

Test status for review on 2acc731fa:

• Passed: the server and UI image builds, the unit tests (manage.py test cvat.apps, 03:48–04:15Z), and every linter, including hadolint.
• Same failure as on security(images): refresh OS packages and pinned dependencies in the runtime images #18: all 4 REST jobs and all 14 e2e jobs stop while starting their test stack. The minio/mc image pulls return unauthorized: access to the requested resource is not authorized, so no test runs. That happens on any run of this base, whatever the change.
• Still running: helm_rest_api_testing.