build: apk add libreoffice24 (#3065)

### Summary

Switches to installing `libreoffice` from the Wolfi repository and
upgrades the `libreoffice` version to `libreoffice==24.x.x`. Resolves a
medium vulnerability in the old `libreoffice` version. Security scanning
with `anchore/grype` was also added to the `test_dockerfile` job.
Requirements were bumped to resolve a vulnerability in the `requests`
library.

### Testing

`test_dockerfile` passes with the updates.

Author: MthwRobinson

.github/workflows/ci.yml

@@ -500,3 +500,8 @@ jobs:
           make docker-dl-packages
           make docker-build
           make docker-test CI=true UNSTRUCTURED_INCLUDE_DEBUG_METADATA=true
+      - name: Scan image
+        uses: anchore/scan-action@v3
+        with:
+          image: "unstructured:dev"
+          severity-cutoff: medium

Dockerfile-amd64

@@ -15,16 +15,16 @@ RUN apk update && apk add py3.11-pip mesa-gl glib cmake && \
   apk add --allow-untrusted packages/poppler-23.09.0-r0.apk && \
   apk add --allow-untrusted packages/leptonica-1.83.0-r0.apk && \
   apk add --allow-untrusted packages/tesseract-5.3.2-r0.apk && \
-  apk add --allow-untrusted packages/libreoffice-7.6.5-r0.apk && \
+  apk add libreoffice && \
   apk add bash && \
   apk add libmagic && \
   mv /share/tessdata/configs /usr/local/share/tessdata/ && \
   mv /share/tessdata/tessconfigs /usr/local/share/tessdata/ && \
-  ln -s /usr/local/lib/libreoffice/program/soffice.bin /usr/local/bin/libreoffice && \
-  ln -s /usr/local/lib/libreoffice/program/soffice.bin /usr/local/bin/soffice && \
-  chmod +x /usr/local/lib/libreoffice/program/soffice.bin && \
-  chmod +x /usr/local/bin/libreoffice && \
-  chmod +x /usr/local/bin/soffice
+  ln -s /usr/lib/libreoffice/program/soffice.bin /usr/bin/libreoffice && \
+  ln -s /usr/lib/libreoffice/program/soffice.bin /usr/bin/soffice && \
+  chmod +x /usr/lib/libreoffice/program/soffice.bin && \
+  chmod +x /usr/bin/libreoffice && \
+  chmod +x /usr/bin/soffice
 
 RUN chown -R nonroot:nonroot /app
 

docs/requirements.txt

@@ -66,7 +66,7 @@ pygments==2.18.0
     #   sphinx-tabs
 pyyaml==6.0.1
     # via myst-parser
-requests==2.31.0
+requests==2.32.1
     # via
     #   -c ./base.txt
     #   sphinx

requirements/base.txt

@@ -25,7 +25,7 @@ dataclasses-json==0.6.6
     # via -r ./base.in
 dataclasses-json-speakeasy==0.5.11
     # via unstructured-client
-emoji==2.11.1
+emoji==2.12.1
     # via -r ./base.in
 filetype==1.2.0
     # via -r ./base.in
@@ -67,11 +67,11 @@ python-iso639==2024.4.27
     # via -r ./base.in
 python-magic==0.4.27
     # via -r ./base.in
-rapidfuzz==3.9.0
+rapidfuzz==3.9.1
     # via -r ./base.in
 regex==2024.5.15
     # via nltk
-requests==2.31.0
+requests==2.32.1
     # via
     #   -r ./base.in
     #   unstructured-client
@@ -89,6 +89,7 @@ tqdm==4.66.4
 typing-extensions==4.11.0
     # via
     #   -r ./base.in
+    #   emoji
     #   typing-inspect
     #   unstructured-client
 typing-inspect==0.9.0

requirements/build.txt

@@ -66,7 +66,7 @@ pygments==2.18.0
     #   sphinx-tabs
 pyyaml==6.0.1
     # via myst-parser
-requests==2.31.0
+requests==2.32.1
     # via
     #   -c ./base.txt
     #   sphinx

requirements/dev.txt

@@ -315,7 +315,7 @@ referencing==0.35.1
     #   jsonschema
     #   jsonschema-specifications
     #   jupyter-events
-requests==2.31.0
+requests==2.32.1
     # via
     #   -c ./base.txt
     #   -c ./test.txt

requirements/extra-paddleocr.txt

@@ -168,13 +168,13 @@ pytz==2024.1
     # via
     #   flask-babel
     #   pandas
-rapidfuzz==3.9.0
+rapidfuzz==3.9.1
     # via
     #   -c ./base.txt
     #   unstructured-paddleocr
 rarfile==4.2
     # via visualdl
-requests==2.31.0
+requests==2.32.1
     # via
     #   -c ./base.txt
     #   premailer

requirements/extra-pdf-image.txt

@@ -58,13 +58,13 @@ googleapis-common-protos==1.63.0
     # via
     #   google-api-core
     #   grpcio-status
-grpcio==1.63.0
+grpcio==1.64.0
     # via
     #   google-api-core
     #   grpcio-status
 grpcio-status==1.62.2
     # via google-api-core
-huggingface-hub==0.23.0
+huggingface-hub==0.23.1
     # via
     #   timm
     #   tokenizers
@@ -220,15 +220,15 @@ pyyaml==6.0.1
     #   omegaconf
     #   timm
     #   transformers
-rapidfuzz==3.9.0
+rapidfuzz==3.9.1
     # via
     #   -c ./base.txt
     #   unstructured-inference
 regex==2024.5.15
     # via
     #   -c ./base.txt
     #   transformers
-requests==2.31.0
+requests==2.32.1
     # via
     #   -c ./base.txt
     #   google-api-core

requirements/huggingface.txt

@@ -27,7 +27,7 @@ fsspec==2024.5.0
     #   -c ././deps/constraints.txt
     #   huggingface-hub
     #   torch
-huggingface-hub==0.23.0
+huggingface-hub==0.23.1
     # via
     #   tokenizers
     #   transformers
@@ -71,7 +71,7 @@ regex==2024.5.15
     #   -c ./base.txt
     #   sacremoses
     #   transformers
-requests==2.31.0
+requests==2.32.1
     # via
     #   -c ./base.txt
     #   huggingface-hub

requirements/ingest/airtable.txt

@@ -4,7 +4,7 @@
 #
 #    pip-compile ./ingest/airtable.in
 #
-annotated-types==0.6.0
+annotated-types==0.7.0
     # via pydantic
 certifi==2024.2.2
     # via
@@ -27,7 +27,7 @@ pydantic==2.7.1
     # via pyairtable
 pydantic-core==2.18.2
     # via pydantic
-requests==2.31.0
+requests==2.32.1
     # via
     #   -c ./ingest/../base.txt
     #   pyairtable