fix: remediate app-layer CVEs in agentex services - #164

Open

scale-ballen wants to merge 11 commits into

mainfrom

sec/fix-app-vulns

Commits on Mar 11, 2026

sec: migrate standard Dockerfiles to Chainguard golden base images

scale-ballen
and
claude
committed
022f03d
fix: address Greptile review findings in agentex Dockerfile

scale-ballen
and
claude
committed
c5e93c1
fix: use BASE_IMAGE arg to allow CI/local dev without ECR auth

scale-ballen
and
claude
committed
bb2e7d1
fix: add ECR auth to integration tests for golden base images

scale-ballen
and
claude
committed
d640f02
fix: use uv sync instead of uv pip install for dependency groups

scale-ballen
and
claude
committed
5c16e67
sec: use minimal ECR read-only role for golden image pulls

scale-ballen
and
claude
committed
ba9f094

Commits on Mar 12, 2026

fix: set SOURCE_DIR build arg in docker-compose for golden image compatibility

scale-ballen
and
claude
committed
ae2eb16
fix: clear ENTRYPOINT on dev stage for Chainguard compatibility

scale-ballen
and
claude
committed
cbf1edb
fix: remove busybox and scope id-token to job level

scale-ballen
and
claude
committed
bdff780
fix: exclude dev dependencies from production image

scale-ballen
and
claude
committed
88218f6

Commits on Mar 16, 2026

fix: upgrade vulnerable dependencies across agentex services

scale-ballen
and
claude
committed
ba4db7d