Dec. 2025 security update #133
Conversation
There was a problem hiding this comment.
Pull request overview
This pull request implements a comprehensive December 2025 security update across multiple components of the system, updating Docker, Go toolchains, Node.js dependencies, and Python packages to address security vulnerabilities.
Key Changes:
- Update Docker and Docker Compose versions in webportal-dind installer
- Upgrade Go toolchains from 1.24.2/1.24.3 to 1.24.9 across multiple services
- Update Node.js dependencies including Express, body-parser, js-yaml, and validator
- Update Kubernetes dependencies and device plugin implementations
- Add security patches and upgrade pip before installing Python dependencies
Reviewed changes
Copilot reviewed 25 out of 31 changed files in this pull request and generated 5 comments.
Show a summary per file
| File | Description |
|---|---|
| src/webportal-dind/build/install.sh | Updates Docker, Docker Compose, and Buildx versions |
| src/watchdog/src/go.mod, src/watchdog/build/watchdog.common.dockerfile | Updates Go toolchain to 1.24.9 |
| src/rest-server/yarn.lock, src/rest-server/package.json | Major dependency updates with version overrides |
| src/pylon/build/reverseproxy.common.dockerfile | Updates FRP version to 0.65.0 with multi-arch support |
| src/hivedscheduler/* | Updates Go toolchain and Kubernetes scheduler version |
| src/frameworkcontroller/* | Updates Go toolchain and removes unused dependencies |
| src/device-plugin/* | Rebuilds device plugins from source with updated dependencies |
| src/database-controller/src/package.json | Updates Express, body-parser, js-yaml with overrides |
| src/dashboard-data-backup/build/* | Adds pip upgrade before dependency installation |
| src/copilot-chat/src/requirements.txt | Adds fonttools security update |
| src/cluster-local-storage/build/* | Upgrades pip and adds urllib3 security patch |
| src/cluster-configuration/deploy/* | Updates Alpine base image to 3.21 |
| src/alert-manager/* | Updates Express, nodemailer, and adds dependency overrides |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| "mocha@* > glob": "10.5.0" | ||
| }, | ||
| "resolutions": { |
There was a problem hiding this comment.
The package.json contains both "overrides" and "resolutions" fields with overlapping dependency version specifications. This creates redundancy and potential confusion. Consider consolidating these into a single mechanism (preferably "overrides" for npm/yarn 2+) or clearly documenting why both are needed.
| "mocha@* > glob": "10.5.0" | |
| }, | |
| "resolutions": { | |
| "mocha@* > glob": "10.5.0", |
| ENV FRP_VERSION=0.65.0 | ||
| # Download the binary from its GitHub releases | ||
| RUN curl -L -o proxy.tar.gz https://github.com/fatedier/frp/releases/download/v0.63.0/frp_0.63.0_linux_amd64.tar.gz && \ | ||
| RUN curl -L -o proxy.tar.gz https://github.com/fatedier/frp/releases/download/v${FRP_VERSION}/frp_${FRP_VERSION}_linux_${TARGETARCH}.tar.gz && \ |
There was a problem hiding this comment.
The FRP download URL uses the TARGETARCH variable directly, but FRP uses different architecture naming conventions. The TARGETARCH value for ARM is "arm64", but FRP releases typically use "amd64", "arm64", etc. You should add architecture mapping logic to ensure the correct FRP binary is downloaded for each platform (e.g., amd64 → amd64, arm64 → arm64). Without this, the build may fail for certain architectures.
src/cluster-local-storage/build/cluster-local-storage.common.dockerfile
Outdated
Show resolved
Hide resolved
| RUN curl -L -o proxy.tar.gz https://github.com/fatedier/frp/releases/download/v${FRP_VERSION}/frp_${FRP_VERSION}_linux_${TARGETARCH}.tar.gz && \ | ||
| tar -zxvf proxy.tar.gz --strip-components=1 -C /app && \ |
There was a problem hiding this comment.
The curl invocation downloads and extracts the frp binary directly from GitHub without any integrity verification (checksum or signature) before incorporating it into the image. If the GitHub release, tag, or network path were compromised, an attacker could supply a malicious frpc binary that runs inside this reverse proxy container with its privileges. To harden the supply chain, pin to an immutable artifact (e.g., a specific release asset hash or commit) and verify its checksum or signature before extraction and use.
| RUN apk --no-cache add git pkgconfig build-base libdrm-dev | ||
| RUN apk --no-cache add hwloc-dev --repository=http://dl-cdn.alpinelinux.org/alpine/edge/community | ||
|
|
||
| RUN mkdir -p /go/src/github.com/ROCm/k8s-device-plugin | ||
| RUN git clone --branch v1.31.0.7 --single-branch https://github.com/ROCm/k8s-device-plugin.git /go/src/github.com/ROCm/k8s-device-plugin | ||
|
|
||
| COPY ./build/k8s-rocm-device-plugin-patches/0001-update-toolchain-to-1.24-with-package-updates.patch /go/src/github.com/ROCm/k8s-device-plugin | ||
|
|
||
| WORKDIR /go/src/github.com/ROCm/k8s-device-plugin | ||
| RUN git apply ./0001-update-toolchain-to-1.24-with-package-updates.patch | ||
|
|
||
| WORKDIR /go/src/github.com/ROCm/k8s-device-plugin/cmd/k8s-device-plugin | ||
|
|
||
| RUN go mod vendor | ||
|
|
||
| RUN go install \ | ||
| -ldflags="-X main.gitDescribe=$(git -C /go/src/github.com/ROCm/k8s-device-plugin/ describe --always --long --dirty)" | ||
|
|
||
| FROM alpine:3.21.3 | ||
|
|
||
| RUN apk --no-cache add ca-certificates libdrm | ||
| RUN apk --no-cache add hwloc --repository=http://dl-cdn.alpinelinux.org/alpine/edge/community |
There was a problem hiding this comment.
These apk add commands install system packages from the Alpine edge/community repository over plain HTTP (http://dl-cdn.alpinelinux.org), which allows a network attacker to tamper with packages in transit. Because these packages are used to build and run a privileged device plugin, a man-in-the-middle on the build network could inject malicious binaries or libraries into the image. Switch the repository URL to HTTPS and ensure all package downloads use TLS so the packages are authenticated and protected from modification in transit.
…ockerfile Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Dec. 2025 security update