From 8f1764cb29e123a8e8ede42444dddf051593271a Mon Sep 17 00:00:00 2001 From: Sergey Yedrikov Date: Tue, 11 Aug 2026 11:10:49 -0400 Subject: [PATCH] Lightspeed Core 0.7.0rc2 CVEs --- .konflux/build-args-konflux.conf | 4 +-- .konflux/redhat.repo | 37 ++++--------------------- .konflux/requirements-build.txt | 8 ++++-- .konflux/requirements.hashes.source.txt | 24 ++++++++-------- .konflux/requirements.hashes.wheel.txt | 4 +-- .konflux/rpms.in.yaml | 5 ++++ .konflux/rpms.lock.yaml | 14 ++++++++++ 7 files changed, 46 insertions(+), 50 deletions(-) diff --git a/.konflux/build-args-konflux.conf b/.konflux/build-args-konflux.conf index a8274f0da..76e3aed7a 100644 --- a/.konflux/build-args-konflux.conf +++ b/.konflux/build-args-konflux.conf @@ -1,4 +1,4 @@ -BUILDER_BASE_IMAGE=quay.io/aipcc/base-images/cpu:3.5.0-1782914735 +BUILDER_BASE_IMAGE=quay.io/aipcc/base-images/cpu:3.5.0-1786384816 BUILDER_DNF_COMMAND=dnf -RUNTIME_BASE_IMAGE=quay.io/aipcc/base-images/cpu:3.5.0-1782914735 +RUNTIME_BASE_IMAGE=quay.io/aipcc/base-images/cpu:3.5.0-1786384816 RUNTIME_DNF_COMMAND=dnf diff --git a/.konflux/redhat.repo b/.konflux/redhat.repo index 54247d627..bbfd4f589 100644 --- a/.konflux/redhat.repo +++ b/.konflux/redhat.repo @@ -1,4 +1,4 @@ -[codeready-builder-for-rhel-9-$basearch-eus-rpms] +[codeready-builder-for-rhel-9-$basearch-eus-rpms__9_DOT_6] name = Red Hat CodeReady Linux Builder for RHEL 9 $basearch - Extended Update Support (RPMs) baseurl = https://cdn.redhat.com/content/eus/rhel9/9.6/$basearch/codeready-builder/os enabled = 1 @@ -11,8 +11,9 @@ metadata_expire = 86400 enabled_metadata = 0 sslclientkey = $SSL_CLIENT_KEY sslclientcert = $SSL_CLIENT_CERT +excludepkgs=*.i686 -[rhel-9-for-$basearch-appstream-eus-rpms] +[rhel-9-for-$basearch-appstream-eus-rpms__9_DOT_6] name = Red Hat Enterprise Linux 9 for $basearch - AppStream - Extended Update Support (RPMs) baseurl = https://cdn.redhat.com/content/eus/rhel9/9.6/$basearch/appstream/os enabled = 1 @@ -25,8 +26,9 @@ metadata_expire = 86400 enabled_metadata = 0 sslclientkey = $SSL_CLIENT_KEY sslclientcert = $SSL_CLIENT_CERT +excludepkgs=*.i686 -[rhel-9-for-$basearch-baseos-eus-rpms] +[rhel-9-for-$basearch-baseos-eus-rpms__9_DOT_6] name = Red Hat Enterprise Linux 9 for $basearch - BaseOS - Extended Update Support (RPMs) baseurl = https://cdn.redhat.com/content/eus/rhel9/9.6/$basearch/baseos/os enabled = 1 @@ -39,31 +41,4 @@ metadata_expire = 86400 enabled_metadata = 0 sslclientkey = $SSL_CLIENT_KEY sslclientcert = $SSL_CLIENT_CERT - -[rhocp-4.17-for-rhel-9-$basearch-rpms] -name = Red Hat OpenShift Container Platform 4.17 for RHEL 9 $basearch (RPMs) -baseurl = https://cdn.redhat.com/content/dist/layered/rhel9/$basearch/rhocp/4.17/os -enabled = 0 -gpgcheck = 1 -gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release -sslverify = 1 -sslcacert = /etc/rhsm/ca/redhat-uep.pem -sslverifystatus = 1 -metadata_expire = 86400 -enabled_metadata = 0 -sslclientkey = $SSL_CLIENT_KEY -sslclientcert = $SSL_CLIENT_CERT - -[rhocp-4.17-for-rhel-9-$basearch-source-rpms] -name = Red Hat OpenShift Container Platform 4.17 for RHEL 9 $basearch (Source RPMs) -baseurl = https://cdn.redhat.com/content/dist/layered/rhel9/$basearch/rhocp/4.17/source/SRPMS -enabled = 0 -gpgcheck = 1 -gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release -sslverify = 1 -sslcacert = /etc/rhsm/ca/redhat-uep.pem -sslverifystatus = 1 -metadata_expire = 86400 -enabled_metadata = 0 -sslclientkey = $SSL_CLIENT_KEY -sslclientcert = $SSL_CLIENT_CERT +excludepkgs=*.i686 diff --git a/.konflux/requirements-build.txt b/.konflux/requirements-build.txt index d8a396187..10dd3524c 100644 --- a/.konflux/requirements-build.txt +++ b/.konflux/requirements-build.txt @@ -14,7 +14,7 @@ flit-core==4.0.2 # via # packaging # pathspec -hatchling==1.31.0 +hatchling==1.32.0 # via # logfire # pydantic-ai @@ -41,7 +41,9 @@ setuptools-scm==10.2.1 # pluggy # setuptools-rust tomlkit==0.15.1 - # via uv-dynamic-versioning + # via + # hatchling + # uv-dynamic-versioning trove-classifiers==2026.6.1.19 # via hatchling uv-dynamic-versioning==0.14.0 @@ -50,7 +52,7 @@ uv-dynamic-versioning==0.14.0 # pydantic-ai-slim # pydantic-evals # pydantic-graph -vcs-versioning==2.2.3 +vcs-versioning==2.2.4 # via setuptools-scm # The following packages are considered to be unsafe in a requirements file: diff --git a/.konflux/requirements.hashes.source.txt b/.konflux/requirements.hashes.source.txt index 656bf91ea..b4204fd37 100644 --- a/.konflux/requirements.hashes.source.txt +++ b/.konflux/requirements.hashes.source.txt @@ -14,21 +14,21 @@ google-cloud-resource-manager==1.18.0 \ logfire==4.40.0 \ --hash=sha256:0ac2c950968812f27ee68ccec4a362230acffaffb28f04945ee07729d5866fa0 \ --hash=sha256:f50f9637f9b5cc3eb5f8526e473effa1992d45056c89adc7c821ee7ab2520c75 -pydantic-ai==2.25.0 \ - --hash=sha256:0190165b01d8f101b5c4c5c4e610a088aed6946b220ca6d55474a67d118a4e47 \ - --hash=sha256:991490b3ceaa258204bbca7749a1da4786b53b29cc5f09b56cc56604023c0c11 +pydantic-ai==2.27.1 \ + --hash=sha256:9ff468db17b31411c85de63f021775afda517c7c3972362888d7c0ad739eb50f \ + --hash=sha256:c36946a1f4f537a14a59703900eba2ca38896b832118804469ae92c8b78ae94b pydantic-ai-skills==1.3.0 \ --hash=sha256:4a8e001054b8c458d9b9b1d7688f0a30602246473ed8dfbe235dc4557b458dff \ --hash=sha256:9940240170fa315640b76ec94be430bea1df55ac6d625a285725b4994f07f86d -pydantic-ai-slim==2.25.0 \ - --hash=sha256:4f5a36f29e2b346d4b793bf3b983aba17ec19f24015bb811ee40815e98155417 \ - --hash=sha256:9b69d1af463a63a88ea3c3567b38a09e8208efe73a36c8f5d5d5515939a88acd -pydantic-evals==2.25.0 \ - --hash=sha256:11780b167271a5a0b6cb51e8972cb8cae9c275358b14fba6a4cf79d8a01d702d \ - --hash=sha256:54f6df9aa30bbe1597f93e65607ba77d76aef0cd9d6804c9f740d909a55769ab -pydantic-graph==2.25.0 \ - --hash=sha256:1e1d61556ec0d5fdc02d307380f6ad4ac96d0bba9e5eac0881bae42466d3db8a \ - --hash=sha256:87017851610746f76463b0b1fd257286425f3b4feac1fd17e50b0370ae76c2cf +pydantic-ai-slim==2.27.1 \ + --hash=sha256:cb86a00f4741cc0b367efccb12ea32286ed96b0d819efe334fec7fd8d5d2b384 \ + --hash=sha256:e26d93c153d1c8301397c874627397c72757a5d47eebdd52ddb3abd7825b9d7f +pydantic-evals==2.27.1 \ + --hash=sha256:ac0effac787c4da4a0e7723fe21817cd7e6bdff6e768c332b4518a3e20b42ae6 \ + --hash=sha256:da5d49a84cce2c51ce4413998cc5c605105487f45ca4ccb44ffefc2d6b392861 +pydantic-graph==2.27.1 \ + --hash=sha256:48f966b77e488083b334fb9bbfa00cb1df193736453481674ecd2ab27dc7401a \ + --hash=sha256:cc0d352dc9ce081ccfefeb7f5ee7fc830c2bc4185ec616af6aeb9269f4e807c1 pythainlp==5.3.5 \ --hash=sha256:147a7a77c5c6d5b387b827ed3b00ee23c3665d242e9d021565cae4c3bca7b2c2 \ --hash=sha256:3be53b97e44fdfc55669705b31a2fe96546146d0c1d90f18999c9b04c4e50c83 diff --git a/.konflux/requirements.hashes.wheel.txt b/.konflux/requirements.hashes.wheel.txt index a83b4e7ff..00594a10e 100644 --- a/.konflux/requirements.hashes.wheel.txt +++ b/.konflux/requirements.hashes.wheel.txt @@ -291,8 +291,8 @@ py-key-value-aio==0.4.5 \ pyaml==26.7.0 \ --hash=sha256:667a4b440272f1376fae57023a213a583a707d29bc4127d354ecc3668adefd7a pyarrow==25.0.0 \ - --hash=sha256:479a525bff931de32df4a666ce09e8e109fda447da5576562cf8e6c4eb4dbe96 \ - --hash=sha256:97e1a5fe8e846857f1a0cd424865fa1cfaae09c2c4f0976cca184e479d3267cc + --hash=sha256:b7cc7bfc4f74e1b44f9699468c26df0925f75cbef99346ac35efac8c13cb71b5 \ + --hash=sha256:dc55a12747b836dfd27b2055e343c6b00d9f726dec25ad097bbe536140b9bc1f pyasn1==0.6.4 \ --hash=sha256:aa4baf3e3b2b894b21127fc4769773650d15543dec5a3756daaa19c0f3763b7f pyasn1-modules==0.4.2 \ diff --git a/.konflux/rpms.in.yaml b/.konflux/rpms.in.yaml index ca64f8cf2..2818f244e 100644 --- a/.konflux/rpms.in.yaml +++ b/.konflux/rpms.in.yaml @@ -7,6 +7,11 @@ packages: cmake, cargo, ] +upgradePackages: + [ + libxslt, + libgcrypt, + ] contentOrigin: repofiles: ["./redhat.repo"] arches: [x86_64, aarch64] diff --git a/.konflux/rpms.lock.yaml b/.konflux/rpms.lock.yaml index d4e4c3df1..b6ce17b4f 100644 --- a/.konflux/rpms.lock.yaml +++ b/.konflux/rpms.lock.yaml @@ -74,6 +74,13 @@ arches: name: info evr: 6.7-15.el9 sourcerpm: texinfo-6.7-15.el9.src.rpm + - url: https://cdn.redhat.com/content/eus/rhel9/9.6/aarch64/baseos/os/Packages/l/libgcrypt-1.10.0-11.el9_6.1.aarch64.rpm + repoid: rhel-9-for-aarch64-baseos-eus-rpms__9_DOT_6 + size: 463379 + checksum: sha256:ca4492eea2902aa597ddc8f9859f5312f2d4e9beafe94b188c014df6f8bbc91f + name: libgcrypt + evr: 1.10.0-11.el9_6.1 + sourcerpm: libgcrypt-1.10.0-11.el9_6.1.src.rpm source: [] module_metadata: [] - arch: x86_64 @@ -148,5 +155,12 @@ arches: name: info evr: 6.7-15.el9 sourcerpm: texinfo-6.7-15.el9.src.rpm + - url: https://cdn.redhat.com/content/eus/rhel9/9.6/x86_64/baseos/os/Packages/l/libgcrypt-1.10.0-11.el9_6.1.x86_64.rpm + repoid: rhel-9-for-x86_64-baseos-eus-rpms__9_DOT_6 + size: 517430 + checksum: sha256:57bb13f2d7b44dafd7ecd20924a5be434223c567ddf5322c8c2d89c800df6d0e + name: libgcrypt + evr: 1.10.0-11.el9_6.1 + sourcerpm: libgcrypt-1.10.0-11.el9_6.1.src.rpm source: [] module_metadata: []