Skip to content

fix(deps): update DOMPurify and runtime image packages #3276

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
alangou merged 1 commit into from
Sep 11, 2026
Merged

fix(deps): update DOMPurify and runtime image packages #3276

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion architecture/build.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -219,6 +219,8 @@ Runtime layout:
gateway binaries must not reference `GLIBC_*` symbols newer than
`GLIBC_2.28`; release workflows verify this before publishing artifacts. The
gateway bundles z3, so the image does not need a distro-provided z3 runtime.
The base is pinned to a multi-architecture digest; distro security updates
require refreshing that digest and rebuilding the gateway image.
- **VM driver**: host GNU-linked binary installed at
`/usr/libexec/openshell/openshell-driver-vm` in Linux packages and published
as a release artifact. Linux GNU VM driver binaries must not reference
Expand All @@ -229,7 +231,8 @@ Runtime layout:
cache action runs. An explicitly configured VM runtime bundle is required to
contain every non-empty embedding input; the driver build fails before
packaging when an input is absent or empty.
- **Supervisor**: Alpine base with `nftables`, static binary at
- **Supervisor**: Alpine base with `nftables`; base packages are upgraded before
installing firewall tools to pick up distro security fixes. Static binary at
`/openshell-sandbox` (musl by default; see `SUPERVISOR_LIBC` above). Static
linkage keeps the binary usable when the image is mounted/extracted into
sandbox environments (Docker extraction, Podman image volumes, Kubernetes
Expand Down
2 changes: 1 addition & 1 deletion deploy/docker/Dockerfile.gateway
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@
#
# Distroless Debian provides the glibc runtime required by the binary.

ARG GATEWAY_BASE_IMAGE=gcr.io/distroless/cc-debian13:nonroot@sha256:d97bc0a941b8d4be647dc0ee75b264ddbb772f1ac5ba690a4309c00723b23775
ARG GATEWAY_BASE_IMAGE=gcr.io/distroless/cc-debian13:nonroot@sha256:c31ff9abcb1910f3ab25c7957bdaf0bfe12a01eb546e8df2282f1c8f682b606c
FROM ${GATEWAY_BASE_IMAGE} AS gateway

ARG TARGETARCH
Expand Down
4 changes: 3 additions & 1 deletion deploy/docker/Dockerfile.supervisor
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,9 @@ FROM alpine:3.22 AS supervisor

ARG TARGETARCH

RUN apk add --no-cache nftables iptables iptables-legacy
# Refresh base packages too: adding firewall tools does not upgrade OpenSSL.
RUN apk upgrade --no-cache \
&& apk add --no-cache nftables iptables iptables-legacy

# Keep the binary root-owned for Podman image-volume mounts and executable by
# the Kubernetes network sidecar's non-root proxy UID.
Expand Down
7 changes: 3 additions & 4 deletions scripts/lint-mermaid/package-lock.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion scripts/lint-mermaid/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,6 @@
"mermaid": "^11.4.0"
},
"overrides": {
"dompurify": "3.4.12"
"dompurify": "3.4.15"
}
}
7 changes: 7 additions & 0 deletions skills/debug-openshell-cluster/SKILL.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -456,6 +456,13 @@ helm -n openshell get values openshell | grep -E 'repository|tag|supervisorImage

The gateway and supervisor images should use the same release tag. A stale supervisor image can make sandbox behavior lag behind gateway policy or protocol changes.

For vulnerability reports, record the running image digest and scan that exact
artifact. The gateway includes a pinned Distroless base; the supervisor includes
Alpine packages updated at image build time. A dependency or base-image fix only
reaches deployed containers after rebuilding, publishing, and redeploying the
images. Compare findings against the SBOM for that digest, not just its mutable
`latest` or `dev` tag.

For plaintext local evaluation, confirm the chart has:

```bash
Expand Down
Loading