Security: Update dependencies to patch CVEs

[moshemorad]

Summary

This PR updates Python dependencies across the project to address multiple security vulnerabilities (CVEs), including Flask, setuptools, and OpenSSL packages.

Key Changes

• Python version requirement: Updated minimum Python version from 3.7.1 to 3.9 in playbooks/pyproject.toml
• Flask upgrade: Bumped Flask from ^2.0.2 to ^3.1.3 in playbooks/pyproject.toml to patch CVE-2023-30861 and CVE-2026-27205
  • Added comment explaining the need to keep this in sync with main pyproject.toml to prevent pip downgrading Flask in Docker
• setuptools upgrade: Updated from ^80.9.0 to >=83.0.0 in pyproject.toml to patch CVE-2026-59890 (MANIFEST.in exclusion bypass in sdist)
  • Also updated Dockerfile to use setuptools>=83.0.0 for consistency
• OpenSSL upgrade: Added installation of libssl3t64, openssl, and openssl-provider-legacy packages in Dockerfile to patch multiple high-severity CVEs (CVE-2026-14456, CVE-2026-14457, CVE-2026-18798, CVE-2026-54874, CVE-2026-63072, CVE-2026-63075, CVE-2026-63076)

Notable Details

• The Flask version constraint in playbooks/pyproject.toml includes a detailed comment explaining why an older cap caused pip to downgrade Flask after Poetry installation in the Docker build process
• setuptools and wheel versions are pinned in the Dockerfile to ensure consistency with the main pyproject.toml requirements

https://claude.ai/code/session_01MN3VfdnF9nV541rYrpK8L6

[github-actions]

✅ Docker image ready for 942e02c (built in 2m 2s)

• us-central1-docker.pkg.dev/robusta-development/temporary-builds/robusta-runner:942e02c

⚠️ Warning: does not support ARM (ARM images are built on release only - not on every PR)

Use this tag to pull the image for testing.

📋 Copy commands

⚠️ Temporary images are deleted after 30 days. Copy to a permanent registry before using them:

gcloud auth configure-docker us-central1-docker.pkg.dev
docker pull us-central1-docker.pkg.dev/robusta-development/temporary-builds/robusta-runner:942e02c
docker tag us-central1-docker.pkg.dev/robusta-development/temporary-builds/robusta-runner:942e02c me-west1-docker.pkg.dev/robusta-development/development/robusta-runner-dev:942e02c
docker push me-west1-docker.pkg.dev/robusta-development/development/robusta-runner-dev:942e02c

Patch Helm values in one line:

helm upgrade --install robusta robusta/robusta \
  --reuse-values \
  --set runner.image=me-west1-docker.pkg.dev/robusta-development/development/robusta-runner-dev:942e02c

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)

• poetry.lock is excluded by !**/*.lock

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 06ec92ad-23cc-4355-9f34-eeb0ca964dee

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: f3b758c2-bc4d-4161-94db-06c93d5372ad

📥 Commits

Reviewing files that changed from the base of the PR and between c2c6392 and dc75918.

⛔ Files ignored due to path filters (1)

• poetry.lock is excluded by !**/*.lock

📒 Files selected for processing (3)

• Dockerfile
• playbooks/pyproject.toml
• pyproject.toml

Included review availability: Your plan provides up to 8 included reviews per hour; 7 remain after this review.

---

Walkthrough

The pull request updates Docker runtime packages and raises Python dependency minimums for setuptools, Python, and Flask. Comments document the related CVE fixes and version synchronization.

Changes

Runtime and dependency updates

Layer / File(s)	Summary
Runtime security dependencies Dockerfile	The runtime image installs OpenSSL 3.5.7 packages and requires setuptools 83.0.0 or newer.
Python package constraints playbooks/pyproject.toml, pyproject.toml	The playbooks package now requires Python 3.9 or newer and Flask 3.1.3 or newer. The root project requires setuptools 83.0.0 or newer.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to dc759

This PR updates dependencies and container packages to address security vulnerabilities; no actionable merge-blocking risk remains after normal checks and review.

Suggested reviewers: naomi-robusta, roiglinik

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely identifies the security-focused dependency updates and CVE remediation described in the changeset.
Description check	✅ Passed	The description directly explains the Python, Flask, setuptools, and OpenSSL updates and their security objectives.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (3 skipped: 3 unsupported.)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/robusta-cve-patches-kv1d4p

---

_{Comment @coderabbitai help to get the list of available commands.}