Repository navigation
chore(deps): security bump for the agent sandbox lock (certifi, pillow, pypdf) - #7845
Conversation
Security fixes for the Python set that ships in the sandbox image (services/runner/images/sandbox/agent-requirements.txt): - certifi 2026.7.22 -> 2026.10.23 (GHSA-6q48-6c7w-9gw2, critical): bundles emSign root CAs with compromised intermediate CA keys. - pillow 12.3.0 -> 13.0.0 (GHSA-5x8w-8jj5-q52h, GHSA-v9pv-5gc8-w2m6, GHSA-332p-7hrc-92wf, GHSA-w889-685w-c8fh, GHSA-8g5g-8vmr-9782, critical): FPX and JPEG heap overflows, TIFF write overflow, Ghostscript argument injection, and stale storage reuse after mode transitions. The lock keeps --require-hashes, so both pins carry the sha256 sums of the released files. The install runs with --no-deps, so moviepy 2.2.1's `pillow<12` cap does not block the patched Pillow 13. The lock is a snapshot recipe input, so this commit also bumps config/sandbox-recipe.json to 4, regenerates sandbox-recipe-fingerprint.json, and updates the docs that name the default snapshot (agenta-agent-sandbox-v3 -> v4). Verification on hetzner-dev: - uv pip install --require-hashes --no-deps -r agent-requirements.txt into a clean Python 3.11 venv: 87 packages installed, pillow 13.0.0 and certifi 2026.10.23 import correctly. - python -m pytest test_recipe_fingerprint.py test_build_snapshot.py: 21 passed. - git diff --check: clean. A v4 snapshot must be built in every Daytona account before a runner that asks for v4 deploys.
📘 Docs preview
Pages changed in this pull request This comment updates in place on every push. |
|
Important Review skippedReview was skipped as selected files did not have any reviewable changes.
 |
| Layer / File(s) | Summary |
|---|---|
Sandbox recipe and dependencies services/runner/config/sandbox-recipe.json, services/runner/images/sandbox/agent-requirements.txt, services/runner/images/sandbox/daytona/README.md, services/runner/images/sandbox/install-agent-tools.sh, services/runner/images/sandbox/daytona/sandbox-recipe-fingerprint.json |
The recipe version changes from 3 to 4. The certifi pin changes to 2026.10.23, the Pillow pin changes to 13.0.0, and the pypdf pin changes to 6.21.2. Package hashes, the recipe fingerprint, and Pillow override references are updated. |
Snapshot references docs/docs/self-host/agents/02-daytona.mdx, docs/docs/self-host/reference/01-configuration.mdx, hosting/README.md, hosting/docker-compose/ee/*.example, hosting/docker-compose/oss/*.example, hosting/kubernetes/helm/values.yaml |
Documentation and configuration examples identify agenta-agent-sandbox-v4 as the pinned or default snapshot. |
Priority:
Estimated code review effort: 2 (Simple) | ~10 minutes
Merge Risk: 
336b2
-
This change upgrades certifi, Pillow and pypdf in the agent sandbox lock to address security advisories, and moves the sandbox snapshot to v4. No concrete merge-blocking defect was found. Before deploying, build the v4 snapshot in each Daytona account that uses it. A quick MoviePy image/video smoke test would add confidence under Pillow 13.
Pre-merge checks: 
-
Check name Status Explanation Title check The title clearly identifies the main change: a security dependency update for the agent sandbox lock involving certifi, pillow, and pypdf. Description check The description directly explains the dependency updates, security advisories, recipe version bump, snapshot reference changes, verification results, and deployment requirement. Docstring Coverage No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Documentation-only edits and deletions within survi… Linked Issues check Check skipped because no linked issues were found for this pull request. Out of Scope Changes check Check skipped because no linked issues were found for this pull request. Full details: Docstring Coverage
-
Explanation
No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 1 files. (2 skipped: 2 unsupported.)
-
Finishing Touches
-
🧪 Generate unit tests (beta)
-
- Commit to this branch
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands.
Railway Preview Environment
Dependent tests finished. Post /preview for manual review. Environment absence verified; retained storage requires separate provider accounting. Post |
pypdf 6.19.0 -> 6.21.2 in services/runner/images/sandbox/agent-requirements.txt. Covers the full pypdf advisory set for this manifest, including the three high-severity ones (arbitrary file write and the PDF writer and text extraction issues). Hashes are the released sdist and wheel sums from PyPI, so `--require-hashes` still holds. The lock is a snapshot recipe input, so the fingerprint is regenerated in the same commit. The recipe version was already bumped to 4 by the previous commit on this branch. Verification on hetzner-dev: - uv pip install --require-hashes --no-deps into a clean Python 3.11 venv: 87 packages; pillow 13.0.0, certifi 2026.10.23 and pypdf 6.21.2 import. - python -m pytest test_recipe_fingerprint.py test_build_snapshot.py: 21 passed.
mmabrouk
changed the title
What
Security updates in the agent sandbox Python lock,
services/runner/images/sandbox/agent-requirements.txt, which ships in both runner images and the Daytona snapshot.ImagingJpegDecodeheap overflow_tiffWriteProcheap overflowThis clears every pypdf alert on this manifest as well, so the file has no open advisories left above low.
The lock keeps
--require-hashes; every new pin carries the sha256 sums of the released files from PyPI. The install runs with--no-deps, so moviepy 2.2.1'spillow<12cap does not block the patched Pillow 13.Why the extra files
agent-requirements.txtis a snapshot recipe input, so CI requires a recipe version bump in the same branch:services/runner/config/sandbox-recipe.json: version 3 -> 4.services/runner/images/sandbox/daytona/sandbox-recipe-fingerprint.json: regenerated after each lock change.agenta-agent-sandbox-v3->agenta-agent-sandbox-v4.install-agent-tools.shand the Daytona README now say Pillow 13.Verification (hetzner-dev, branch head 336b239)
uv pip install --require-hashes --no-deps -r agent-requirements.txtinto a clean Python 3.11 venv: 87 packages installed;pillow 13.0.0,certifi 2026.10.23andpypdf 6.21.2import correctly.python -m pytest test_recipe_fingerprint.py test_build_snapshot.py: 21 passed.git diff --check: clean.Baseline: these tests also pass on unmodified
main; no pre-existing failures were involved.Deploy note
The recipe version bump makes
agenta-agent-sandbox-v4the default snapshot name. A v4 snapshot must be built in every Daytona account that uses it before a runner asking for v4 deploys.