LCORE-3523: Lightspeed Core 0.7.0rc2 RPM CVEs

.konflux/build-args-konflux.conf

@@ -1,4 +1,4 @@
-BUILDER_BASE_IMAGE=quay.io/aipcc/base-images/cpu:3.5.0-1782914735
+BUILDER_BASE_IMAGE=quay.io/aipcc/base-images/cpu:3.5.0-1786384816
 BUILDER_DNF_COMMAND=dnf
-RUNTIME_BASE_IMAGE=quay.io/aipcc/base-images/cpu:3.5.0-1782914735
+RUNTIME_BASE_IMAGE=quay.io/aipcc/base-images/cpu:3.5.0-1786384816
 RUNTIME_DNF_COMMAND=dnf

.konflux/redhat.repo

@@ -1,4 +1,4 @@
-[codeready-builder-for-rhel-9-$basearch-eus-rpms]
+[codeready-builder-for-rhel-9-$basearch-eus-rpms__9_DOT_6]
 name = Red Hat CodeReady Linux Builder for RHEL 9 $basearch - Extended Update Support (RPMs)
 baseurl = https://cdn.redhat.com/content/eus/rhel9/9.6/$basearch/codeready-builder/os
 enabled = 1
@@ -11,8 +11,9 @@ metadata_expire = 86400
 enabled_metadata = 0
 sslclientkey = $SSL_CLIENT_KEY
 sslclientcert = $SSL_CLIENT_CERT
+excludepkgs=*.i686
 
-[rhel-9-for-$basearch-appstream-eus-rpms]
+[rhel-9-for-$basearch-appstream-eus-rpms__9_DOT_6]
 name = Red Hat Enterprise Linux 9 for $basearch - AppStream - Extended Update Support (RPMs)
 baseurl = https://cdn.redhat.com/content/eus/rhel9/9.6/$basearch/appstream/os
 enabled = 1
@@ -25,8 +26,9 @@ metadata_expire = 86400
 enabled_metadata = 0
 sslclientkey = $SSL_CLIENT_KEY
 sslclientcert = $SSL_CLIENT_CERT
+excludepkgs=*.i686
 
-[rhel-9-for-$basearch-baseos-eus-rpms]
+[rhel-9-for-$basearch-baseos-eus-rpms__9_DOT_6]
 name = Red Hat Enterprise Linux 9 for $basearch - BaseOS - Extended Update Support (RPMs)
 baseurl = https://cdn.redhat.com/content/eus/rhel9/9.6/$basearch/baseos/os
 enabled = 1
@@ -39,31 +41,4 @@ metadata_expire = 86400
 enabled_metadata = 0
 sslclientkey = $SSL_CLIENT_KEY
 sslclientcert = $SSL_CLIENT_CERT
-
-[rhocp-4.17-for-rhel-9-$basearch-rpms]
-name = Red Hat OpenShift Container Platform 4.17 for RHEL 9 $basearch (RPMs)
-baseurl = https://cdn.redhat.com/content/dist/layered/rhel9/$basearch/rhocp/4.17/os
-enabled = 0
-gpgcheck = 1
-gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
-sslverify = 1
-sslcacert = /etc/rhsm/ca/redhat-uep.pem
-sslverifystatus = 1
-metadata_expire = 86400
-enabled_metadata = 0
-sslclientkey = $SSL_CLIENT_KEY
-sslclientcert = $SSL_CLIENT_CERT
-
-[rhocp-4.17-for-rhel-9-$basearch-source-rpms]
-name = Red Hat OpenShift Container Platform 4.17 for RHEL 9 $basearch (Source RPMs)
-baseurl = https://cdn.redhat.com/content/dist/layered/rhel9/$basearch/rhocp/4.17/source/SRPMS
-enabled = 0
-gpgcheck = 1
-gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
-sslverify = 1
-sslcacert = /etc/rhsm/ca/redhat-uep.pem
-sslverifystatus = 1
-metadata_expire = 86400
-enabled_metadata = 0
-sslclientkey = $SSL_CLIENT_KEY
-sslclientcert = $SSL_CLIENT_CERT
+excludepkgs=*.i686

.konflux/requirements-build.txt

@@ -14,7 +14,7 @@ flit-core==4.0.2
     # via
     #   packaging
     #   pathspec
-hatchling==1.31.0
+hatchling==1.32.0
     # via
     #   logfire
     #   pydantic-ai
@@ -41,7 +41,9 @@ setuptools-scm==10.2.1
     #   pluggy
     #   setuptools-rust
 tomlkit==0.15.1
-    # via uv-dynamic-versioning
+    # via
+    #   hatchling
+    #   uv-dynamic-versioning
 trove-classifiers==2026.6.1.19
     # via hatchling
 uv-dynamic-versioning==0.14.0
@@ -50,7 +52,7 @@ uv-dynamic-versioning==0.14.0
     #   pydantic-ai-slim
     #   pydantic-evals
     #   pydantic-graph
-vcs-versioning==2.2.3
+vcs-versioning==2.2.4
     # via setuptools-scm
 
 # The following packages are considered to be unsafe in a requirements file:

.konflux/requirements.hashes.source.txt

@@ -14,21 +14,21 @@ google-cloud-resource-manager==1.18.0 \
 logfire==4.40.0 \
     --hash=sha256:0ac2c950968812f27ee68ccec4a362230acffaffb28f04945ee07729d5866fa0 \
     --hash=sha256:f50f9637f9b5cc3eb5f8526e473effa1992d45056c89adc7c821ee7ab2520c75
-pydantic-ai==2.25.0 \
-    --hash=sha256:0190165b01d8f101b5c4c5c4e610a088aed6946b220ca6d55474a67d118a4e47 \
-    --hash=sha256:991490b3ceaa258204bbca7749a1da4786b53b29cc5f09b56cc56604023c0c11
+pydantic-ai==2.27.1 \
+    --hash=sha256:9ff468db17b31411c85de63f021775afda517c7c3972362888d7c0ad739eb50f \
+    --hash=sha256:c36946a1f4f537a14a59703900eba2ca38896b832118804469ae92c8b78ae94b
 pydantic-ai-skills==1.3.0 \
     --hash=sha256:4a8e001054b8c458d9b9b1d7688f0a30602246473ed8dfbe235dc4557b458dff \
     --hash=sha256:9940240170fa315640b76ec94be430bea1df55ac6d625a285725b4994f07f86d
-pydantic-ai-slim==2.25.0 \
-    --hash=sha256:4f5a36f29e2b346d4b793bf3b983aba17ec19f24015bb811ee40815e98155417 \
-    --hash=sha256:9b69d1af463a63a88ea3c3567b38a09e8208efe73a36c8f5d5d5515939a88acd
-pydantic-evals==2.25.0 \
-    --hash=sha256:11780b167271a5a0b6cb51e8972cb8cae9c275358b14fba6a4cf79d8a01d702d \
-    --hash=sha256:54f6df9aa30bbe1597f93e65607ba77d76aef0cd9d6804c9f740d909a55769ab
-pydantic-graph==2.25.0 \
-    --hash=sha256:1e1d61556ec0d5fdc02d307380f6ad4ac96d0bba9e5eac0881bae42466d3db8a \
-    --hash=sha256:87017851610746f76463b0b1fd257286425f3b4feac1fd17e50b0370ae76c2cf
+pydantic-ai-slim==2.27.1 \
+    --hash=sha256:cb86a00f4741cc0b367efccb12ea32286ed96b0d819efe334fec7fd8d5d2b384 \
+    --hash=sha256:e26d93c153d1c8301397c874627397c72757a5d47eebdd52ddb3abd7825b9d7f
+pydantic-evals==2.27.1 \
+    --hash=sha256:ac0effac787c4da4a0e7723fe21817cd7e6bdff6e768c332b4518a3e20b42ae6 \
+    --hash=sha256:da5d49a84cce2c51ce4413998cc5c605105487f45ca4ccb44ffefc2d6b392861
+pydantic-graph==2.27.1 \
+    --hash=sha256:48f966b77e488083b334fb9bbfa00cb1df193736453481674ecd2ab27dc7401a \
+    --hash=sha256:cc0d352dc9ce081ccfefeb7f5ee7fc830c2bc4185ec616af6aeb9269f4e807c1
 pythainlp==5.3.5 \
     --hash=sha256:147a7a77c5c6d5b387b827ed3b00ee23c3665d242e9d021565cae4c3bca7b2c2 \
     --hash=sha256:3be53b97e44fdfc55669705b31a2fe96546146d0c1d90f18999c9b04c4e50c83

.konflux/requirements.hashes.wheel.txt

@@ -291,8 +291,8 @@ py-key-value-aio==0.4.5 \
 pyaml==26.7.0 \
     --hash=sha256:667a4b440272f1376fae57023a213a583a707d29bc4127d354ecc3668adefd7a
 pyarrow==25.0.0 \
-    --hash=sha256:479a525bff931de32df4a666ce09e8e109fda447da5576562cf8e6c4eb4dbe96 \
-    --hash=sha256:97e1a5fe8e846857f1a0cd424865fa1cfaae09c2c4f0976cca184e479d3267cc
+    --hash=sha256:b7cc7bfc4f74e1b44f9699468c26df0925f75cbef99346ac35efac8c13cb71b5 \
+    --hash=sha256:dc55a12747b836dfd27b2055e343c6b00d9f726dec25ad097bbe536140b9bc1f
 pyasn1==0.6.4 \
     --hash=sha256:aa4baf3e3b2b894b21127fc4769773650d15543dec5a3756daaa19c0f3763b7f
 pyasn1-modules==0.4.2 \

.konflux/rpms.in.yaml

@@ -7,6 +7,11 @@ packages:
     cmake,
     cargo,
   ]
+upgradePackages:
+  [
+    libxslt,
+    libgcrypt,
+  ]
 contentOrigin:
   repofiles: ["./redhat.repo"]
 arches: [x86_64, aarch64]

.konflux/rpms.lock.yaml

@@ -74,6 +74,13 @@ arches:
     name: info
     evr: 6.7-15.el9
     sourcerpm: texinfo-6.7-15.el9.src.rpm
+  - url: https://cdn.redhat.com/content/eus/rhel9/9.6/aarch64/baseos/os/Packages/l/libgcrypt-1.10.0-11.el9_6.1.aarch64.rpm
+    repoid: rhel-9-for-aarch64-baseos-eus-rpms__9_DOT_6
+    size: 463379
+    checksum: sha256:ca4492eea2902aa597ddc8f9859f5312f2d4e9beafe94b188c014df6f8bbc91f
+    name: libgcrypt
+    evr: 1.10.0-11.el9_6.1
+    sourcerpm: libgcrypt-1.10.0-11.el9_6.1.src.rpm
   source: []
   module_metadata: []
 - arch: x86_64
@@ -148,5 +155,12 @@ arches:
     name: info
     evr: 6.7-15.el9
     sourcerpm: texinfo-6.7-15.el9.src.rpm
+  - url: https://cdn.redhat.com/content/eus/rhel9/9.6/x86_64/baseos/os/Packages/l/libgcrypt-1.10.0-11.el9_6.1.x86_64.rpm
+    repoid: rhel-9-for-x86_64-baseos-eus-rpms__9_DOT_6
+    size: 517430
+    checksum: sha256:57bb13f2d7b44dafd7ecd20924a5be434223c567ddf5322c8c2d89c800df6d0e
+    name: libgcrypt
+    evr: 1.10.0-11.el9_6.1
+    sourcerpm: libgcrypt-1.10.0-11.el9_6.1.src.rpm
   source: []
   module_metadata: []