Skip to content

[SecVul] [1.1.x] ui/mlrun-ui Critical#3728

Merged
muli-cohen merged 2 commits into
mlrun:feature/ig4from
pini-sh-panda:ORIS-3203
Jul 15, 2026
Merged

[SecVul] [1.1.x] ui/mlrun-ui Critical#3728
muli-cohen merged 2 commits into
mlrun:feature/ig4from
pini-sh-panda:ORIS-3203

Conversation

@pini-sh-panda

@pini-sh-panda pini-sh-panda commented Jul 15, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

📝 Description

Revert temporary Docker Hub pull for nginx-unprivileged now that DevOps synced 1.31.2-alpine3.23 to the internal GCR mirror

🛠️ Changes Made

  • Dockerfile:
Base image: nginxinc/nginx-unprivileged:1.31.2-alpine3.23 → gcr.io/iguazio/nginx-unprivileged:1.31.2-alpine3.23

✅ Checklist

  • I have given the PR a well-structured title describing the domain and the specific change that was made
  • I tested the changes in the browser (locally or via preview build)
  • I confirmed that existing tests pass
  • I added or updated unit / integration tests (if needed)
  • I checked that this change doesn’t introduce new console warnings or lint / formatting errors
  • I updated the relevant Jira ticket with the appropriate details and status

🔗 References

🚨 Potentially Breaking Changes

  • Yes
  • No

Includes DRC change

  • Yes
  • No

If yes -> requires bump NPM version

🔍 Additional Notes

📸 Screenshots / Demos

PiniSh and others added 2 commits July 13, 2026 11:42
@claude
[SecVul] fix curl/nginx CVEs in mlrun-ui image (IG4-3203, IG4-3204)
eae6bca 
- Bump nginx base image 1.31.1 -> 1.31.2-alpine3.23 (fixes CVE-2026-42055,
  CVE-2026-42530). Temporarily pulled from Docker Hub upstream until DevOps
  syncs the tag to the internal artifactory mirror.
- Remove curl/libcurl in the production stage: unused at runtime and the
  patched 8.21.0-r0 build is not yet in the Alpine 3.23 repos, so apk upgrade
  cannot patch it. Clears the curl/libcurl CVE group.
- chmod run_nginx 777 -> 755 to drop the world-writable bit (SonarQube).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
[mlrun-ui] Switch nginx base image back to internal GCR mirror (IG4-3…
082937a 
…203, IG4-3204)

DevOps synced the 1.31.2-alpine3.23 tag to gcr.io/iguazio/nginx-unprivileged,
so revert the temporary Docker Hub upstream pull used as a stopgap
@pini-sh-panda
pini-sh-panda requested a review from muli-cohen July 15, 2026 15:45
@muli-cohen
muli-cohen merged commit cb7443a into mlrun:feature/ig4 Jul 15, 2026
3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@muli-cohen muli-cohen muli-cohen approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@pini-sh-panda @muli-cohen