Merge pull request #69 from epam/development

hotfix: merge dependency updates
epam · Feb 13, 2024 · 5f9eed7 · 5f9eed7
2 parents 16e633d + c32707b
commit 5f9eed7
Show file tree

Hide file tree

Showing 4 changed files with 102 additions and 111 deletions.
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
@@ -4,8 +4,8 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
-      day: "wednesday"
-      time: "09:00"
+      day: "tuesday"
+      time: "13:34"
     # Disable version updates, keep security updates only
     open-pull-requests-limit: 0
     commit-message:

diff --git a/Dockerfile b/Dockerfile
@@ -3,9 +3,6 @@ FROM python:3.11-alpine AS builder
 
 ARG POETRY_VERSION=1.6.1
 
-# Vulnerability fix: CVE-2023-5363
-RUN apk update && apk upgrade --no-cache libcrypto3 libssl3
-
 # Install alpine-sdk to compile some langchain dependencies (numexpr, numpy)
 RUN apk add --no-cache alpine-sdk linux-headers
 
@@ -37,6 +34,8 @@ ENV LOG_LEVEL=INFO
 
 # Vulnerability fix: CVE-2023-5363
 RUN apk update && apk upgrade --no-cache libcrypto3 libssl3
+# Vulnerability fix: CVE-2023-52425
+RUN apk upgrade --no-cache libexpat
 
 # Install libstdc++ to run the compiled dependencies
 RUN apk add --no-cache libstdc++