fix(security): update runtime certificate trust in v0.10.x

.devcontainer/devcontainer.json

@@ -4,8 +4,8 @@
     "dockerfile": "Dockerfile",
     "args": {
       "TOOLS_GO_VERSION": "1.26.10",
-      "TOOLS_NODE_VERSION": "24.13.0",
-      "TOOLS_UV_VERSION": "0.10.4",
+      "TOOLS_NODE_VERSION": "24.22.1",
+      "TOOLS_UV_VERSION": "0.13.5",
       "TOOLS_K9S_VERSION": "0.50.4",
       "TOOLS_KIND_VERSION": "0.27.0",
       "TOOLS_ISTIO_VERSION": "1.26.0",

Makefile

@@ -96,7 +96,7 @@ LDFLAGS := -X github.com/$(DOCKER_REPO)/go/core/internal/version.Version=$(VERSI
            -X github.com/$(DOCKER_REPO)/go/core/internal/version.BuildDate=$(BUILD_DATE)
 
 #tools versions
-TOOLS_UV_VERSION ?= 0.10.4
+TOOLS_UV_VERSION ?= 0.13.5
 TOOLS_NODE_VERSION ?= 24
 TOOLS_PYTHON_VERSION ?= 3.13
 

docker/skills-init/Dockerfile

@@ -31,7 +31,7 @@ ARG PYTHON_GID=1001
 # git is invoked by skills-init via exec.Command with an argv vector — never
 # through a shell — so the only attack surface here is git itself. OCI fetch
 # uses the in-process go-containerregistry library, so krane and jq are gone.
-RUN apk upgrade --no-cache && apk add --no-cache git openssh-client ca-certificates
+RUN apk upgrade --no-cache && apk add --no-cache git openssh-client "ca-certificates>=20261020-r0"
 
 COPY --from=builder /skills-init /usr/local/bin/skills-init
 

go/Dockerfile

@@ -32,7 +32,7 @@ RUN --mount=type=cache,target=/root/go/pkg/mod,rw             \
 ### STAGE 2: final image
 # Use distroless as minimal base image to package the manager binary
 # Refer to https://github.com/GoogleContainerTools/distroless for more details
-FROM gcr.io/distroless/static:nonroot
+FROM gcr.io/distroless/static-debian13:nonroot@sha256:d62067879de890a1def9da0e7766b7d20810a5e5555cef8506b752437d7a3e88
 ARG TARGETPLATFORM
 
 WORKDIR /

go/Dockerfile.full

@@ -23,12 +23,12 @@ RUN --mount=type=cache,target=/root/go/pkg/mod,rw \
     CGO_ENABLED=0 GOOS=${TARGETOS:-linux} GOARCH=${TARGETARCH} go build -ldflags "$LDFLAGS" -o /app "$BUILD_PACKAGE"
 
 # sandbox-runtime produces architecture-independent JavaScript; build it natively to avoid QEMU.
-FROM --platform=$BUILDPLATFORM $BASE_IMAGE_REGISTRY/chainguard/wolfi-base:latest AS srt-builder
+FROM --platform=$BUILDPLATFORM $BASE_IMAGE_REGISTRY/chainguard/wolfi-base:latest@sha256:bc76fa39ddd1482dd56a761b3331e03ba8f0e093ebb525618a56d014b480da88 AS srt-builder
 ARG TOOLS_PYTHON_VERSION=3.13
 
 RUN --mount=type=cache,target=/var/cache/apk,rw \
     apk add --no-cache \
-    bash git ca-certificates nodejs npm node-gyp bubblewrap python-${TOOLS_PYTHON_VERSION} libstdc++
+    bash git "ca-certificates>=20260909-r3" nodejs npm node-gyp bubblewrap python-${TOOLS_PYTHON_VERSION} libstdc++
 
 # Keep the pinned sandbox-runtime revision, but replace its vulnerable locked package versions.
 # Both lodash-es and shell-quote are direct dependencies of sandbox-runtime, so pinning them
@@ -42,12 +42,12 @@ RUN --mount=type=cache,target=/root/.npm \
     npm run build && \
     npm prune --omit=dev
 
-FROM $BASE_IMAGE_REGISTRY/chainguard/wolfi-base:latest
+FROM $BASE_IMAGE_REGISTRY/chainguard/wolfi-base:latest@sha256:bc76fa39ddd1482dd56a761b3331e03ba8f0e093ebb525618a56d014b480da88
 ARG TOOLS_PYTHON_VERSION=3.13
 
 RUN --mount=type=cache,target=/var/cache/apk,rw \
     apk add --no-cache \
-    bash ca-certificates curl nodejs bubblewrap socat python-${TOOLS_PYTHON_VERSION} ripgrep libstdc++
+    bash "ca-certificates>=20260909-r3" curl nodejs bubblewrap socat python-${TOOLS_PYTHON_VERSION} ripgrep libstdc++
 
 RUN addgroup -g 1001 goagent && \
     adduser -u 1001 -G goagent -s /bin/bash -D goagent

python/Dockerfile

@@ -1,18 +1,19 @@
 ### STAGE 1: uv binary
-ARG UV_VERSION=0.12.3
+ARG UV_VERSION=0.13.5
 FROM ghcr.io/astral-sh/uv:${UV_VERSION} AS uv-bin
 
 ### STAGE 2: builder
 # Build the uv-managed standalone Python interpreter and the project venv on a full base
 # (debian-slim, digest-pinnable). Nothing from this stage ships except /python and the venv.
-# Digest = multi-arch index resolved via `docker buildx imagetools inspect debian:12-slim`.
-FROM debian:13-slim@sha256:020c0d20b9880058cbe785a9db107156c3c75c2ac944a6aa7ab59f2add76a7bd AS builder
+# Digest = multi-arch index resolved via `docker buildx imagetools inspect debian:13-slim`.
+FROM debian:13-slim@sha256:62bd423aeee912639ca8ee681c2b762cb3e25137e0a92b20be455898a9f034ad AS builder
 ARG TOOLS_PYTHON_VERSION=3.13
 
 ENV LANG=C.UTF-8
 ENV LC_ALL=C.UTF-8
 ENV PYTHONOPTIMIZE=2
 ENV PYTHONUNBUFFERED=1
+ENV GRPC_DEFAULT_SSL_ROOTS_FILE_PATH=/etc/ssl/certs/ca-certificates.crt
 
 # uv configuration: install a managed standalone Python under /python and a copy-mode venv
 # (no editable installs) so the final image is self-contained with no source tree dependency.
@@ -27,7 +28,7 @@ ENV UV_PYTHON_INSTALL_DIR=/python
 ENV UV_PYTHON_PREFERENCE=only-managed
 
 RUN apt-get update \
-    && apt-get install -y --no-install-recommends ca-certificates \
+    && apt-get satisfy -y --no-install-recommends 'ca-certificates (>= 20250419+deb13u1)' \
     && rm -rf /var/lib/apt/lists/*
 
 COPY --from=uv-bin /uv /uvx /usr/local/bin/
@@ -82,15 +83,19 @@ RUN mkdir -p /staging/config
 # version-numbered tags (only :nonroot/:latest/:debug), so a digest is the only way to pin tighter
 # than "Debian 12". Tag kept for readability; bump the digest via dependency tooling.
 # Digest = multi-arch index resolved via `docker buildx imagetools inspect gcr.io/distroless/cc-debian12:nonroot`.
-FROM gcr.io/distroless/cc-debian12:nonroot@sha256:fccdbb0a547c14e23fcf4ce8ad62ca5d43b4faae8d22cd292f490fef9946c96e
+FROM gcr.io/distroless/cc-debian12:nonroot@sha256:9dac0a79194e45a7da0158a9c6da57b217585af0786db3845d1f0ec1a0dd182f
 ARG VERSION
 
 ENV LANG=C.UTF-8
 ENV LC_ALL=C.UTF-8
 ENV PYTHONUNBUFFERED=1
+ENV GRPC_DEFAULT_SSL_ROOTS_FILE_PATH=/etc/ssl/certs/ca-certificates.crt
 ENV PATH="/.kagent/.venv/bin:$PATH"
 ENV VIRTUAL_ENV=/.kagent/.venv
 
+# Preserve the runtime glibc version while using Debian's updated CA bundle.
+COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
+
 # The standalone interpreter and the venv (the venv's python is linked to /python).
 COPY --from=builder /python /python
 COPY --from=builder /.kagent/.venv /.kagent/.venv

python/Dockerfile.full

@@ -6,20 +6,21 @@
 # executeCodeBlocks) and for sandboxed BYO agents.
 
 ### STAGE 1: uv binary
-ARG UV_VERSION=0.12.3
+ARG UV_VERSION=0.13.5
 FROM ghcr.io/astral-sh/uv:${UV_VERSION} AS uv-bin
 
 ### STAGE 2: base os + sandbox runtime
 # node:26-bookworm-slim is a digest-pinnable debian-bookworm base that ships Node 26 (the
 # sandbox-runtime requires node >= 20; debian's own nodejs package is still on 18).
 # Digest = multi-arch index resolved via `docker buildx imagetools inspect node:26-bookworm-slim`.
-FROM node:26-bookworm-slim@sha256:2d49d876e96237d76de412761cf05dbfe5aee325cc4406a4d41d5824c5bb8beb AS python-os
+FROM node:26.12.1-bookworm-slim@sha256:28147155d47dc31abe0a46e0d12b59b2fb3d0a2dcc5dc65fce76a074180b16fe AS python-os
 ARG TOOLS_PYTHON_VERSION=3.13
 
 ENV LANG=C.UTF-8
 ENV LC_ALL=C.UTF-8
 ENV PYTHONOPTIMIZE=2
 ENV PYTHONUNBUFFERED=1
+ENV GRPC_DEFAULT_SSL_ROOTS_FILE_PATH=/etc/ssl/certs/ca-certificates.crt
 
 # Optimize malloc for containerized Python workloads
 ENV MALLOC_TRIM_THRESHOLD_=262144
@@ -39,8 +40,8 @@ ENV UV_PYTHON_PREFERENCE=only-managed
 
 # node/npm come from the base image; add the remaining runtime tooling.
 RUN apt-get update \
-    && apt-get install -y --no-install-recommends \
-        curl openssl bash git ca-certificates \
+    && apt-get satisfy -y --no-install-recommends \
+        curl openssl bash git 'ca-certificates (>= 20250419~deb12u2)' \
         bubblewrap socat ripgrep \
     && rm -rf /var/lib/apt/lists/*
 

python/packages/kagent-adk/pyproject.toml

@@ -35,7 +35,7 @@ dependencies = [
   "filelock>=3.20.3",  # CVE-2025-68146, CVE-2026-22701: TOCTOU symlink race condition
   "python-multipart>=0.0.22",  # CVE-2026-24486: Arbitrary file write via path traversal
   "httpx-sse>=0.4.3",  # U+2028/U+2029 SSE line terminator fix (0.4.2) + performance regression fix (0.4.3)
-  "boto3>=1.28.57",
+  "boto3>=1.43.117",
   "ollama >=0.3.6",  # Ollama SDK
   "numpy>=2.2.6",
 ]

python/packages/kagent-core/pyproject.toml

@@ -9,6 +9,7 @@ description = "kagent common library for kagent python packages"
 readme = "README.md"
 requires-python = ">=3.11"
 dependencies = [
+  "certifi>=2026.10.19",
   "a2a-sdk[http-server]>=0.3.26",
   "opentelemetry-api>=1.38.0,<1.39.0",
   "opentelemetry-sdk>=1.38.0,<1.39.0",

python/pyproject.toml

@@ -11,6 +11,7 @@ dev = [
 
 [tool.uv]
 constraint-dependencies = [
+    "uv>=0.13.5",
     "aiohttp>=3.14.3",
     "cryptography>=50.0.0",
     "httplib2>=0.32.0",

python/samples/crewai/poem_flow/Dockerfile

@@ -3,7 +3,10 @@ ARG DOCKER_REGISTRY=ghcr.io
 ARG VERSION=latest
 # substrate's gVisor (ateom) checkpoint/restore segfaults processes linked against trixie's newer glibc
 # use bookworm to align with the kagent-adk runtime image
-FROM ghcr.io/astral-sh/uv:python3.13-bookworm-slim
+FROM python:3.13.17-slim-bookworm@sha256:e32be0e55814a08977501ca863271d9bd02443710db8f2afaf8372e2c4508530
+COPY --from=ghcr.io/astral-sh/uv:0.13.5 /uv /uvx /usr/local/bin/
+
+ENV GRPC_DEFAULT_SSL_ROOTS_FILE_PATH=/etc/ssl/certs/ca-certificates.crt
 
 WORKDIR /app
 

python/samples/crewai/research-crew/Dockerfile

@@ -3,7 +3,10 @@ ARG DOCKER_REGISTRY=ghcr.io
 ARG VERSION=latest
 # substrate's gVisor (ateom) checkpoint/restore segfaults processes linked against trixie's newer glibc
 # use bookworm to align with the kagent-adk runtime image
-FROM ghcr.io/astral-sh/uv:python3.13-bookworm-slim
+FROM python:3.13.17-slim-bookworm@sha256:e32be0e55814a08977501ca863271d9bd02443710db8f2afaf8372e2c4508530
+COPY --from=ghcr.io/astral-sh/uv:0.13.5 /uv /uvx /usr/local/bin/
+
+ENV GRPC_DEFAULT_SSL_ROOTS_FILE_PATH=/etc/ssl/certs/ca-certificates.crt
 
 WORKDIR /app
 

python/samples/langgraph/currency/Dockerfile

@@ -3,7 +3,10 @@ ARG DOCKER_REGISTRY=ghcr.io
 ARG VERSION=latest
 # substrate's gVisor (ateom) checkpoint/restore segfaults processes linked against trixie's newer glibc
 # use bookworm to align with the kagent-adk runtime image
-FROM ghcr.io/astral-sh/uv:python3.13-bookworm-slim
+FROM python:3.13.17-slim-bookworm@sha256:e32be0e55814a08977501ca863271d9bd02443710db8f2afaf8372e2c4508530
+COPY --from=ghcr.io/astral-sh/uv:0.13.5 /uv /uvx /usr/local/bin/
+
+ENV GRPC_DEFAULT_SSL_ROOTS_FILE_PATH=/etc/ssl/certs/ca-certificates.crt
 
 WORKDIR /app
 

python/samples/langgraph/hitl-tools/Dockerfile

@@ -3,7 +3,10 @@ ARG DOCKER_REGISTRY=ghcr.io
 ARG VERSION=latest
 # substrate's gVisor (ateom) checkpoint/restore segfaults processes linked against trixie's newer glibc
 # use bookworm to align with the kagent-adk runtime image
-FROM ghcr.io/astral-sh/uv:python3.13-bookworm-slim
+FROM python:3.13.17-slim-bookworm@sha256:e32be0e55814a08977501ca863271d9bd02443710db8f2afaf8372e2c4508530
+COPY --from=ghcr.io/astral-sh/uv:0.13.5 /uv /uvx /usr/local/bin/
+
+ENV GRPC_DEFAULT_SSL_ROOTS_FILE_PATH=/etc/ssl/certs/ca-certificates.crt
 
 WORKDIR /app
 

python/samples/langgraph/kebab/Dockerfile

@@ -3,7 +3,10 @@ ARG DOCKER_REGISTRY=ghcr.io
 ARG VERSION=latest
 # substrate's gVisor (ateom) checkpoint/restore segfaults processes linked against trixie's newer glibc
 # use bookworm to align with the kagent-adk runtime image
-FROM ghcr.io/astral-sh/uv:python3.13-bookworm-slim
+FROM python:3.13.17-slim-bookworm@sha256:e32be0e55814a08977501ca863271d9bd02443710db8f2afaf8372e2c4508530
+COPY --from=ghcr.io/astral-sh/uv:0.13.5 /uv /uvx /usr/local/bin/
+
+ENV GRPC_DEFAULT_SSL_ROOTS_FILE_PATH=/etc/ssl/certs/ca-certificates.crt
 
 WORKDIR /app
 

python/samples/openai/basic_agent/Dockerfile

@@ -1,5 +1,7 @@
 ### STAGE 1: base image
-FROM ghcr.io/astral-sh/uv:python3.13-trixie-slim
+FROM ghcr.io/astral-sh/uv:0.13.5-python3.13-trixie-slim
+
+ENV GRPC_DEFAULT_SSL_ROOTS_FILE_PATH=/etc/ssl/certs/ca-certificates.crt
 
 WORKDIR /app