fix: patch OS-level CVEs in Docker image

[ryanmcmillan]

Summary

Adds apt-get update && apt-get upgrade -y to the Dockerfile to patch fixable OS-level vulnerabilities in the Debian 12 base image.

What this fixes

Snyk found 73 OS-level CVEs in python:3.13.3-slim (Debian 12 Bookworm). 25 have upstream fixes available:

• 2 Critical: sqlite3 (CVE-2025-6965)
• 6 High: gnutls (double free, heap overflow), perl (cert validation), pam (directory traversal), openssl (CVE-2025-69421), gnupg (OOB write)
• 7 Medium: gnutls (null ptr, algorithmic complexity), pam, others

The remaining 48 low-severity findings have no Debian fix available yet.

Why this is safe

apt-get upgrade only installs patched versions of already-installed packages. No new packages added. Build stays reproducible with the pinned python:3.13.3-slim base.

[greptile-apps]

Greptile Summary

This PR adds a single apt-get update && apt-get upgrade -y step to the Dockerfile to patch 25 of the 73 OS-level CVEs that Snyk identified in the python:3.13.3-slim (Debian 12 Bookworm) base image, including 2 critical sqlite3 CVEs and 6 high-severity issues in gnutls, openssl, pam, and others.

Key changes:

• A new RUN layer is inserted immediately after the FROM statement to apply all available Debian security patches.
• Package lists are cleaned up in the same layer (rm -rf /var/lib/apt/lists/*), keeping the image size minimal.

Considerations:

• DEBIAN_FRONTEND=noninteractive is not set. Some packages upgraded by this step may trigger debconf interactive configuration prompts that -y alone does not suppress, which can cause builds to hang in CI.
• While the FROM base image is pinned, apt-get upgrade resolves package versions from the live Debian repos at build time. The image content will drift across builds over time — the PR description's claim of full reproducibility is slightly overstated, though this is an accepted trade-off for security patching.

Confidence Score: 4/5

• Safe to merge — the change is minimal, targeted, and correctly structured; one minor best-practice gap to address.
• The change is a single well-formed RUN instruction that follows Docker best practices (cleanup in the same layer). It addresses real, documented CVEs with no new packages added. The only actionable issue is the missing DEBIAN_FRONTEND=noninteractive, which is a low-risk but non-trivial omission in CI environments where debconf prompts could cause the build to hang.
• No files require special attention beyond the Dockerfile comment noted above.

Important Files Changed

Filename	Overview
Dockerfile	Adds an apt-get update/upgrade layer to patch 25 OS-level CVEs in the Debian 12 base image; correctly cleans package lists in the same layer. Minor: DEBIAN_FRONTEND=noninteractive is missing, which can cause debconf prompts to hang CI builds.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A["FROM python:3.13.3-slim\n(Debian 12 Bookworm base)"] --> B

    subgraph NEW ["🆕 New layer (this PR)"]
        B["RUN apt-get update &&\napt-get upgrade -y &&\nrm -rf /var/lib/apt/lists/*\n\n→ Patches 25 CVEs (2 Critical, 6 High, 7 Medium)"]
    end

    B --> C["WORKDIR /app"]
    C --> D["COPY backend/requirements.txt\nRUN pip install -r requirements.txt"]
    D --> E["COPY backend /app/backend\nCOPY README.md / LICENSE"]
    E --> F["ENV DELEGA_HOST / PORT / AUTH / DB_PATH"]
    F --> G["VOLUME /app/data\nEXPOSE 18890\nHEALTHCHECK"]
    G --> H["CMD: run migrations → start main.py"]

    style NEW fill:#d4edda,stroke:#28a745,color:#000

Loading

_{Last reviewed commit: "fix: add apt-get upg..."}

[greptile-apps]

Set DEBIAN_FRONTEND=noninteractive for non-interactive apt runs

Without DEBIAN_FRONTEND=noninteractive, certain packages (e.g. tzdata, libreadline) can trigger debconf configuration prompts during apt-get upgrade. The -y flag only handles yes/no confirmations — it does not suppress interactive debconf dialogs. This can cause the build to hang or produce unexpected behavior in CI environments.

Suggested change

	RUN apt-get update && apt-get upgrade -y && rm -rf /var/lib/apt/lists/*
	RUN DEBIAN_FRONTEND=noninteractive apt-get update && apt-get upgrade -y && rm -rf /var/lib/apt/lists/*