fixes vulnerabilities in the vpc agent

Dockerfile

@@ -1,57 +1,71 @@
-FROM python:3.12-bullseye
+FROM python:3.12-bookworm AS builder
 
 RUN apt-get update \
-  # dependencies for building Python packages \
-  && apt-get install -y build-essential \
-  # psycopg2 dependencies
-  && apt-get install -y libpq-dev \
-  # Translations dependencies
-  && apt-get install -y gettext \
-  # Nginx
-  && apt-get install -y nginx vim procps curl libpq-dev -y --no-install-recommends \
+  && apt-get upgrade -y \
+  && apt-get install -y build-essential libpq-dev gettext curl \
+  && apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false \
+  && rm -rf /var/lib/apt/lists/*
+
+# Install Rust for building dependencies
+ENV PATH="/root/.cargo/bin:${PATH}"
+RUN curl https://sh.rustup.rs -sSf | sh -s -- -y
+
+WORKDIR /build
+
+COPY requirements.txt /build/
+RUN pip install uv
+RUN uv pip install --system --target /build/deps -r requirements.txt
+
+# ---- Runtime stage ----
+FROM python:3.12-slim-trixie
+
+RUN apt-get update \
+  && apt-get upgrade -y \
+  && apt-get install -y --no-install-recommends \
+  libpq5 \
+  nginx \
+  procps \
+  curl \
   # Install kubectl
   && ARCH=$(dpkg --print-architecture) \
   && curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/${ARCH}/kubectl" \
   && install -o root -g root -m 0755 kubectl /usr/local/bin/kubectl \
+  && rm kubectl \
   # Install Otterize CLI (optional - skip if download fails)
   && (curl -LJO https://get.otterize.com/otterize-cli/v2.0.3/otterize_linux_x86_64.tar.gz && \
-      file otterize_linux_x86_64.tar.gz | grep -q "gzip compressed" && \
-      tar xf otterize_linux_x86_64.tar.gz && \
-      install -o root -g root -m 0755 otterize /usr/local/bin/otterize && \
-      rm otterize_linux_x86_64.tar.gz) || echo "Otterize CLI installation skipped" \
-  # cleaning up unused files
+  file otterize_linux_x86_64.tar.gz | grep -q "gzip compressed" && \
+  tar xf otterize_linux_x86_64.tar.gz && \
+  install -o root -g root -m 0755 otterize /usr/local/bin/otterize && \
+  rm otterize_linux_x86_64.tar.gz) || echo "Otterize CLI installation skipped" \
+  # Clean up
   && apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false \
-  && rm -rf /var/lib/apt/lists/* \
-  && rm kubectl
+  && rm -rf /var/lib/apt/lists/*
 
 COPY nginx.default /etc/nginx/sites-available/default
 RUN ln -sf /dev/stdout /var/log/nginx/access.log \
-    && ln -sf /dev/stderr /var/log/nginx/error.log
+  && ln -sf /dev/stderr /var/log/nginx/error.log
 
 # Set environment variables
 ENV PIP_DISABLE_PIP_VERSION_CHECK=1
 ENV PYTHONDONTWRITEBYTECODE=1
 ENV PYTHONUNBUFFERED=1
+ENV PYTHONPATH="/code/deps:${PYTHONPATH}"
+ENV PATH="/code/deps/bin:${PATH}"
 
 # VCS metadata
 ARG COMMIT_HASH=unknown
 ENV VPC_AGENT_COMMIT_HASH=${COMMIT_HASH}
 
-# Install Rust for building dependencies
-ENV PATH="/root/.cargo/bin:${PATH}"
-RUN curl https://sh.rustup.rs -sSf | sh -s -- -y
-
 # Set work directory
 WORKDIR /code
 
+# Copy installed dependencies from builder
+COPY --from=builder /build/deps /code/deps
+
 # Copy project
 COPY . /code
 RUN chown -R www-data:www-data /code
 
-# Install requirements whenever update available
-RUN pip install uv
-RUN uv pip sync requirements.txt --system
-
 COPY scripts/start-celery-worker.sh .
 RUN sed -i 's/\r$//g' start-celery-worker.sh
 RUN chmod +x start-celery-worker.sh

helm/Chart.lock

@@ -0,0 +1,12 @@
+dependencies:
+- name: celery-beat
+  repository: file://charts/celery_beat
+  version: 0.1.0
+- name: celery-worker
+  repository: file://charts/celery_worker
+  version: 0.1.0
+- name: redis
+  repository: file://charts/redis
+  version: 0.1.0
+digest: sha256:89a974ed81461af8cfc9b3a96f26ac961a1124cee6c5f291a1cd2ba73601557c
+generated: "2026-03-16T16:16:53.729664+05:30"

requirements.txt

@@ -3,9 +3,9 @@ annotated-types==0.7.0
 anyio==4.6.0
 asgiref==3.8.1
 async-timeout==4.0.3
-awscli==1.38.6
+awscli>=1.44.38
 azure-common==1.1.28
-azure-core==1.31.0
+azure-core>=1.38.0
 azure-identity==1.16.1
 azure-mgmt-authorization==4.0.0
 azure-mgmt-core==1.4.0
@@ -15,12 +15,12 @@ azure-monitor-query==1.3.0
 backoff==2.2.1
 bcrypt==4.2.0
 billiard==4.2.0
-boto3==1.37.6
-botocore==1.37.6
+boto3>=1.42.48
+botocore==1.42.48
 cachetools==5.5.0
 celery==5.3.4
 certifi==2024.8.30
-cffi==1.17.1
+cffi>=2.0.0
 charset-normalizer==3.3.2
 click==8.1.7
 click-didyoumean==0.3.1
@@ -30,18 +30,18 @@ clickhouse-connect==0.6.23
 clickhouse-driver==0.2.6
 clickhouse-pool==0.5.3
 colorama==0.4.4
-cryptography==43.0.1
+cryptography>=46.0.5
 datadog-api-client==2.15.0
 defusedxml==0.7.1
 distro==1.9.0
 dj-database-url==1.2.0
 dj-email-url==1.0.6
 dj-rest-auth==2.2.7
-Django==4.1.4
-django-allauth==0.52.0
+Django>=4.2.14,<5
+django-allauth>=65.14.1
 django-appconf==1.0.5
 django-cache-url==3.4.4
-django-celery-beat==2.4.0
+django-celery-beat>=2.5.0
 django-celery-email==3.0.0
 django-clickhouse-backend==1.0.3
 django-cors-headers==3.13.0
@@ -50,12 +50,12 @@ django-filter==22.1
 django-prometheus==2.2.0
 django-redis==5.2.0
 django-rest-auth==0.9.5
-django-ses==3.3.0
+django-ses>=3.5.0
 django-timezone-field==5.0
-djangorestframework==3.14.0
-djangorestframework-simplejwt==5.2.2
-dnspython==1.16.0
-docutils==0.16
+djangorestframework>=3.15.2
+djangorestframework-simplejwt>=5.5.1
+dnspython>=2.6.1
+docutils>=0.18.1,<=0.19
 durationpy==0.7
 elastic-transport==8.15.0
 elasticsearch==8.15.1
@@ -77,8 +77,8 @@ grpcio==1.74.0
 grpcio-status==1.71.2
 grpcio-tools==1.70.0
 gunicorn==22.0.0
-h11==0.14.0
-httpcore==1.0.5
+h11>=0.16.0
+httpcore>=1.0.9
 httplib2==0.22.0
 httpx==0.27.2
 idna==3.10
@@ -87,8 +87,8 @@ jmespath==1.0.1
 kombu==5.3.4
 kubernetes==26.1.0
 lz4==4.3.3
-marshmallow==3.22.0
-msal==1.31.0
+marshmallow>=3.26.2,<4
+msal>=1.35.0
 msal-extensions==1.2.0
 msrest==0.7.1
 multidict==6.1.0
@@ -107,17 +107,17 @@ portalocker==2.10.1
 prometheus_client==0.21.0
 prompt_toolkit==3.0.47
 proto-plus==1.24.0
-protobuf==5.29.5
+protobuf>=5.29.6
 psycopg2-binary==2.9.5
-pyasn1==0.6.1
+pyasn1>=0.6.2
 pyasn1_modules==0.4.1
 pycparser==2.22
 pydantic==2.9.2
 pydantic_core==2.23.4
-PyJWT==2.9.0
-pymongo==3.9.0
+PyJWT>=2.12.0
+pymongo>=4.6.3
 PyMySQL==1.1.1
-PyNaCl==1.5.0
+PyNaCl>=1.6.2
 pyparsing==3.1.4
 python-crontab==3.2.0
 python-dateutil==2.9.0.post0
@@ -126,28 +126,28 @@ python3-openid==3.2.0
 pytz==2024.2
 PyYAML==6.0.2
 redis==5.0.8
-requests==2.28.2
+requests>=2.32.0
 requests-oauthlib==2.0.0
 requests-toolbelt==1.0.0
 rsa==4.7.2
-s3transfer==0.11.4
+s3transfer>=0.16.0,<0.17.0
 six==1.16.0
 slack_sdk>=3.26.2
 sniffio==1.3.1
 SQLAlchemy==1.4.54
-sqlparse==0.5.1
+sqlparse>=0.5.4
 tenacity==9.0.0
 tqdm==4.66.5
 types-protobuf==6.30.2.20250809
 typing_extensions==4.12.2
 tzdata==2024.2
 tzlocal==5.2
 uritemplate==4.1.1
-urllib3==1.26.20
+urllib3>=2.6.0
 vine==5.1.0
 wcwidth==0.2.13
 websocket-client==1.8.0
 yarl==1.12.1
 zstandard==0.23.0
 # Latest version of drdroid-debug-toolkit -> added logql cleanup
-git+https://github.com/DrDroidLab/drdroid-debug-toolkit.git@master
+git+https://github.com/DrDroidLab/drdroid-debug-toolkit.git@feat/bumps-django-version