run-llama / llama-agents / 36166704289
85%

DEFAULT BRANCH: main
Ran
Jobs 0
Files 0
Run time –
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
36166704289

push

github

web-flow 
Patch known vulnerabilities in the operator, appserver and control plane images (#777)

## What changed

- Operator image: builder `golang:1.24` → `golang:1.26`, `go.mod` `go
1.26.0`, and grpc, x/net, x/sys, x/text, cel-go and the OpenTelemetry
modules moved to releases with fixes. `golangci-lint` pinned to v2.11.4
in `go-ci.yml` and `operator/Makefile` because the v2.1/v2.2 release
binaries are built with Go 1.24 and refuse a Go 1.26 module; `go-ci.yml`
sets up Go 1.26 to match.
- Python images: `uv.lock` bumps for gitpython, cryptography, pyjwt,
aiohttp, anyio, python-multipart and pydantic-settings; the base image's
pip is upgraded in the shared base stage.
- Appserver: npm upgraded to the 11.x line (the Node 22 bundle's npm 10
carries fixed-upstream `tar` and friends); curl and gnupg purged after
the NodeSource repo is added. git, Node, corepack and uv stay.
- Patch changesets for the operator, appserver, control-plane and the
`llama-agents` chart, so the next version PR republishes the images and
a chart pointing at them.

## Why

grype on the published images reported fixable findings on all three
(operator 86, control-plane 66, appserver 38, unique
id×package×version). This clears every finding with an upstream fix
except the ten on the Python 3.12.14 interpreter itself, whose fixes
exist only on 3.13+.

## Verification

All images built with `docker buildx build --platform linux/amd64` and
scanned with grype 0.108.0 (DB built 2026-09-22T06:30:41Z). Unique
findings by fix state, before → after:

| Image | Before (total / C / H / fixable) | After (total / C / H /
fixable) | Won't fix | Not fixed | Unknown |
|---|---|---|---|---|---|
| llama-agents-control-plane | 214 / 2 / 73 / 66 | 158 / 0 / 50 / 10 |
100 | 46 | 2 |
| llama-agents-appserver | 468 / 28 / 131 / 38 | 348 / 10 / 91 / 10 |
195 | 141 | 2 |
| llama-agents-operator | 86 / 1 / 47 / 86 | 0 / 0 / 0 / 0 | 0 | 0 | 0 |

The 10 fixable findings left on each Python image are all on
`/usr/local... (continued)
Source Files on build 36166704289
Detailed source file information is not available for this build.