Skip to content

BB2-4848: Remove Dockerfile from project root to address security concerns#1653

Open
JamesDemeryNava wants to merge 4 commits into
masterfrom
jamesdemery/bb2-4848-update-dockerfile
Open

BB2-4848: Remove Dockerfile from project root to address security concerns#1653
JamesDemeryNava wants to merge 4 commits into
masterfrom
jamesdemery/bb2-4848-update-dockerfile

Conversation

@JamesDemeryNava

@JamesDemeryNava JamesDemeryNava commented Jul 13, 2026

Copy link
Copy Markdown
Contributor

JIRA Ticket:
BB2-4848

What Does This PR Do?

Removes the Dockerfile from the project root, as it is no longer used, and contains security vulnerability.

What Should Reviewers Watch For?

If you're reviewing this PR, please check for these things in particular:

Validation

  • Check out the branch
  • Run make build-local, then make run-local. Ensure you can go through the testclient, do a refresh token flow through Postman, etc.

What Security Implications Does This PR Have?

Please indicate if this PR does any of the following:

  • Adds any new software dependencies
  • Modifies any security controls
  • Adds new transmission or storage of data
  • Any other changes that could possibly affect security?
  • Yes, one or more of the above security implications apply. This PR must not be merged without the ISSO or team
    security engineer's approval.

Any Migrations?

  • Yes, there are migrations
    • The migrations should be run PRIOR to the code being deployed
    • The migrations should be run AFTER the code is deployed
    • There is a more complicated migration plan (downtime,
      etc)
  • No migrations

Comment thread Dockerfile Outdated

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Wouldn't we want to change the base image instead of adding it as a package here? Changing line 1 from python3.12 to something else? I know that might make it more involved since we'd have to test this other version and make sure it is backwards compatible.

@JamesDemeryNava JamesDemeryNava marked this pull request as draft July 13, 2026 14:04
@JamesDemeryNava JamesDemeryNava marked this pull request as ready for review July 14, 2026 12:57
@JamesDemeryNava JamesDemeryNava changed the title BB2-4848: Update Debian:13 python3.13 to version 3.13.5-2+deb13u3 BB2-4848: Remove Dockerfile from project root to address security concerns Jul 14, 2026
@sb-DarenDean

Copy link
Copy Markdown

LGTM! We can have another Eng review & approve. But we are good. I already removed them from SNYK.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants