Security: Bump dependencies and remove gnupg2 from runtime

[moshemorad]

Summary

This PR addresses multiple security vulnerabilities by bumping dependency versions and removes unnecessary packages from the Docker runtime image to reduce the attack surface.

Key Changes

Dependency Updates (pyproject.toml):

• Bumped idna to >=3.15 to fix CVE-2026-45409 / GHSA-65pc-fj4g-8rjx
• Bumped kafka-python to ^2.3.2 to fix CVE-2026-10142 and CVE-2026-10143 (High severity DoS vulnerabilities)
• Bumped cryptography to ^48.0.1 to fix GHSA-537c-gmf6-5ccf (High severity)
• Bumped pyjwt to ^2.13.0 to fix CVE-2026-48526 and CVE-2026-48522/48523/48525
• Bumped pyasn1 to >=0.6.4 to fix CVE-2026-59885 and CVE-2026-59886 (High severity)
• Added pillow ^12.3.0 to main dependencies (was only transitive) to fix 10 High severity CVEs
• Added click >=8.3.3 to main dependencies (was only transitive) to fix CVE-2026-7246 (command injection)
• Bumped python-dotenv to ^1.2.2 to fix CVE-2026-28684
• Bumped tornado to ^6.5.7 to fix CVE-2026-49853, CVE-2026-49855, and GHSA-pw6j-qg29-8w7f

Docker Runtime Image Optimization (Dockerfile):

• Replaced ssh metapackage with openssh-client only (removes unused openssh-server and openssh-sftp-server that carry unfixed CVEs including CVE-2026-60002)
• Removed gnupg2 from runtime dependencies by using ASCII-armored key format directly with apt (avoids gnupg/dirmngr/gpgsm package family and CVE-2026-24882)
• Simplified kubectl key setup to use gpg --dearmor removal and direct ASCII-armored key handling
• Added --no-install-recommends flag to kubectl installation
• Cleaned up temporary key file handling

Notable Implementation Details

• Pillow and click are now explicitly pinned in main dependencies rather than relying on transitive resolution, ensuring consistent security updates
• The Dockerfile changes maintain functionality while reducing the runtime image's CVE footprint by eliminating packages that are never used in the application
• The kubectl key setup now leverages modern apt capabilities to avoid the need for gnupg2 in the runtime image

https://claude.ai/code/session_01KKy2VCrJKoDNiNrUvjkt8y

[github-actions]

✅ Docker image ready for 785b0b3 (built in 2m 25s)

• us-central1-docker.pkg.dev/robusta-development/temporary-builds/robusta-runner:785b0b3

⚠️ Warning: does not support ARM (ARM images are built on release only - not on every PR)

Use this tag to pull the image for testing.

📋 Copy commands

⚠️ Temporary images are deleted after 30 days. Copy to a permanent registry before using them:

gcloud auth configure-docker us-central1-docker.pkg.dev
docker pull us-central1-docker.pkg.dev/robusta-development/temporary-builds/robusta-runner:785b0b3
docker tag us-central1-docker.pkg.dev/robusta-development/temporary-builds/robusta-runner:785b0b3 me-west1-docker.pkg.dev/robusta-development/development/robusta-runner-dev:785b0b3
docker push me-west1-docker.pkg.dev/robusta-development/development/robusta-runner-dev:785b0b3

Patch Helm values in one line:

helm upgrade --install robusta robusta/robusta \
  --reuse-values \
  --set runner.image=me-west1-docker.pkg.dev/robusta-development/development/robusta-runner-dev:785b0b3

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)

• poetry.lock is excluded by !**/*.lock

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 5f2b4ad5-8ef3-4c24-aa21-b7dc94418df5

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

Walkthrough

The Docker runtime image now uses a narrower SSH package set, removes runtime GnuPG, and configures the Kubernetes repository with a keyring. Python dependency constraints and related advisory comments were updated across several packages.

Changes

Security updates

Layer / File(s)	Summary
Runtime image package and repository setup Dockerfile	The runtime installs openssh-client instead of ssh, omits gnupg2, and uses an .asc apt keyring through signed-by for kubectl installation.
Python dependency constraint updates pyproject.toml	Version requirements and advisory comments were updated for multiple Python dependencies, including idna, kafka-python, cryptography, pyjwt, Pillow, and tornado.
Estimated code review effort: 3 (Moderate)	~20 minutes

Possibly related PRs

• robusta-dev/robusta#2106: Overlaps on filelock and virtualenv dependency constraints.
• robusta-dev/robusta#2122: Overlaps on several CVE-related dependency updates.

Suggested reviewers: roiglinik

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately summarizes the main security-focused dependency bumps and runtime image cleanup.
Description check	✅ Passed	The description is directly related to the dependency updates and Docker runtime changes in the pull request.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/holmes-cve-scan-patch-sq0uc0

---

_{Comment @coderabbitai help to get the list of available commands.}