run-llama / llama-agents / 41103025626
85%

DEFAULT BRANCH: main
Ran
Jobs 12
Files 235
Run time 1min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 85.173%. Remained the same
41103025626

push

github

web-flow 
Apply Debian security updates in the appserver and control plane images (#846)

## Why
Grype finds **CVE-2026-111497 (CISA KEV, Brotli, due 2026-11-10)** in
`llamaindex/llama-agents-appserver:0.12.2`, the newest release,
published 10-23. The finding is `libbrotli1 1.1.0-2+b7`, inherited from
`python:3.12-slim`. Debian has released the fix (`1.1.0-2+deb13u1`), but
the base image hasn't picked it up yet. The control plane image builds
from the same `base` stage.

We found it running in staging (`llama-agents-byoc`) during this week's
KEV cleanup in run-llama/platform.

## Change
- `docker/Dockerfile`: the shared `base` stage now runs `apt-get update
&& apt-get upgrade -y`, so every image built from it gets Debian's
current security updates.
- A changeset bumps `llama-agents-appserver` and
`llama-agents-control-plane` (patch), so the publish workflow ships
fixed images.

## Note on nodejs
Grype also lists the NodeSource `nodejs` 22.23.4 deb against the same
CVE, with no fix version. Its binary matcher gives 22.23.4 as the fixed
release, so that entry looks like a deb-matcher false positive.
NodeSource `setup_22.x` installs the newest 22.x at build time anyway.

## Ask
Once this merges, a patch release (0.12.3) would let us move staging and
the SaaS agents off 0.12.2.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

18962 of 22263 relevant lines covered (85.17%)

1.15 hits per line

Jobs
ID Job ID Ran Files Coverage
1 llama-agents-agentcore - 41103025626.1 5
70.22
GitHub Action Run
2 llamactl - 41103025626.2 48
79.79
GitHub Action Run
3 llama-agents-core - 41103025626.3 15
81.34
GitHub Action Run
4 llama-agents-integration-tests - 41103025626.4 102
64.93
GitHub Action Run
5 llama-agents-server - 41103025626.5 31
86.15
GitHub Action Run
6 llama-index-utils-workflow - 41103025626.6 1
70.84
GitHub Action Run
7 llama-agents-control-plane - 41103025626.7 31
74.57
GitHub Action Run
8 llama-agents-appserver - 41103025626.8 17
81.96
GitHub Action Run
9 llama-agents-client - 41103025626.9 4
95.32
GitHub Action Run
10 llama-index-workflows - 41103025626.10 53
94.18
GitHub Action Run
11 llama-agents-dev - 41103025626.11 12
76.5
GitHub Action Run
12 llama-agents-dbos - 41103025626.12 11
75.72
GitHub Action Run
Source Files on build 41103025626