Repository navigation
fix(openhands): ship 0.71.3 with security-patched images - #1387
Conversation
Base for 0.71.3: 0.71.2's Copa image pins don't carry forward. charts/ and replicated/ are restored from openhands/0.71.1; .github/ and the chart version (0.71.2) are kept so release-please cuts 0.71.3.
Follows the restore: 0.71.2 pointed this test at the Copa-patched paths.
Rebuilt hotfix releases (1.64.0-r1, 1.49.5-r1-python) name the release they rebuild; release_tag() now strips -rN as it already strips -patched and digest pins.
Pins the PR-build candidate digests of the 7 in-house images, default ghcr.io/openhands/* repositories. The -r1 tags do not exist yet; the tag text is ignored because a digest is present. Replace each digest with the rescanned -r1 release digest once the hotfix PRs are tagged. agent-canvas carries the STAGING PostHog key (OpenHands#18258 candidate build) and must never ship: it needs the manual cancel-and-dispatch release before this pin is final. agent-server tag keeps 1.49.5 as its first segment so enterprise's get_agent_server_image() rewrite (default repository only) leaves it unchanged.
… and jobs Every wait-for-db, create-db and create-db-user container hardcoded either bitnamilegacy/postgresql:latest or postgres:14. All but Keycloak's bypassed the Replicated proxy and the airgap registry rewrite, and :latest was unpinned. Route all of them through global.postgresClientImage, pinned by digest to postgres:16.15-alpine, and mirror it in the online and local-registry Replicated values. Keycloak's wait-for-db keeps uid 1001, which the Bitnami image used to supply.
Optional on top of the previous commit: drop it to stay on the Docker Official postgres:16.15-alpine image. postgres:16.15-alpine still reports 1 CRITICAL and 24 HIGH fixable findings, all in the Go stdlib of its gosu binary, which none of these containers run. alpine/psql 18.6 ships only the client tools and scans clean (0 CRITICAL/HIGH). psql 18 supports servers back to 9.2, and the image runs every site's command with output identical to the old images against PostgreSQL 13, 16 and 18.
|
| Location | Value |
|---|---|
charts/openhands/Chart.yaml → appVersion |
1.64.0 |
charts/openhands/values.yaml → image.tag |
1.64.0-r1@sha256:6c137216f1c6afe1d560300e92990a52050064a1358472c314285ae8e0bf8307 |
Fix: set appVersion to 1.64.0-r1@sha256:6c137216f1c6afe1d560300e92990a52050064a1358472c314285ae8e0bf8307 in charts/openhands/Chart.yaml.
This is a notice, not a blocking check.
Changing either chart makes release-please propose a release of it on release/0.71. The sync check now reads 1.49.5-r1-python as 1.49.5-python, so image-loader can stay on the release tag, as it did for 0.71.2. The crd-check edit was a doc comment (the chart is consumed as OCI 0.1.0).
…on third-party-images rebuilds Same upstream versions rebuilt in OpenHands/third-party-images with current Debian packages and Go helpers. Fixable C/H (2026-10-12 DB): keycloak 23/155 -> 6/59, postgresql 17/67 -> 0/0, redis 17/74 -> 0/0, Laminar postgres 1/24 -> 0/0. Airgap repository names are unchanged because the images keep their last path segment. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
(cherry picked from commit 7dba3ea)
(cherry picked from commit 35238c1)
(cherry picked from commit c5004ff)
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Both ran on the floating latest tag. 0.1.825 (lmnr build of 2026-10-12, the current latest) has no fixable HIGH/CRITICAL findings. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
… test builds agent-server 973f316 (software-agent-sdk#5691, Debian snapshot 20261012T234422Z) and the agent-canvas build on top of it (OpenHands#18258). Both are 3/20 fixable; the released -r1 digests replace these before 0.71.3 is cut. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
dylan-openhands
changed the title
Validation: Helm upgrade 0.71.1 → this PR (505c0f1) on a local kind clusterSetup: single-node kind (Kubernetes 1.26). Chart 0.71.1 installed from GHCR (not the Replicated registry), Traefik ingress, bundled Postgres, Redis, and Keycloak, Laminar enabled. The values mirror a Helm self-hosted install: How the test exercises the change: the upgrade swaps every bundled image (Keycloak bitnamilegacy 26.3.0 → third-party-images 26.8.0, bitnamilegacy Postgres and Redis → third-party-images, the
Upgrade result: the first Sandbox image label: the sandbox pod spec shows This comment was drafted by an AI agent on behalf of the user. |
Validation: Helm upgrade 0.71.1 → this PR (505c0f1) on GKESetup: GKE
First Login is down for about 4 minutes during the upgrade. Sandbox image label: same as on kind. The sandbox pod spec shows This comment was drafted by an AI agent on behalf of the user. |
…s and runtime-api agent-server 1.49.5-r1-python, agent-canvas 1.23.0-r1 and runtime-api 0.10.0-r1 now point at the release-tag builds instead of the branch candidates. enterprise-server 1.64.0-r1 is a retag of the already-pinned candidate, so its digest is unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
openhands-release-bot
Bot
added
the
released: openhands/0.71.3
|
🚀 Released in openhands/0.71.3. |
2 participants
What
This is 0.71.3 for the 0.71.x hotfix line, which ships to C3. It starts from 0.71.1's
charts/andreplicated/, so none of 0.71.2's Copa-patched images carry forward. Each image is then re-pinned to a rebuilt image or a newer image from the same release line..github/, including the Beta deploy guard, and the chart version are kept fromrelease/0.71; release-please proposes 0.71.3.Tracking: PLTF-3723.
Where each image comes from
1.64.0-r16c137216…)0.10.0-r1v0.10.0-r11.49.5-r1-python1.49.5-r11.23.0-r1v1.23.0-r1on agent-server1.49.5-r1-python, with the prod PostHog key0.1.825, pinned by digest; previously the floatinglatestglobal.postgresClientImage(alpine/psql:18.6), replacing 11 hardcodedbitnamilegacy/postgresql:latest/postgres:14referencesVulnerability result
These are the images C3's Helm values enable, the same set as their own scan. Both versions were rendered and scanned with Trivy on the 2026-10-12 DB, HIGH/CRITICAL, unique CVE × package. The four OpenHands images were scanned on linux/amd64 and linux/arm64, with identical results.
All 3 / 15 remaining fixable findings are in agent-server, and agent-canvas reports the same 18. None is exploitable in the image:
extensions/{handlebars,npm,grunt,json,ini,diff}/package.json) that Trivy misreads as the npm libraries of the same name.pkg_resources, which doesn't contain the vulnerablepackage_index.py.The gh, Docker Buildx, Docker Compose and RootlessKit findings are fixed: #5691 rebuilds the first three from upstream source with patched Go modules and takes RootlessKit 3.3.0. An OpenVEX document for the 18 is in
security/agent-server-1.49.5-hotfix.openvex.jsonin software-agent-sdk, scoped to the candidate digests.The per-image table is on PLTF-3723. Images that a default KOTS install runs but C3 doesn't (MinIO, sysbox, alpine/k8s and others) weren't rescanned for this version.
Fleet upgrade test (shared-2)
shared-2 was clean-installed on 0.71.1 (Replicated sequence 1863), then upgraded through the admin console to this PR at
505c0f1(sequence 1864,0.71.3-rc.1), on the bundled Postgres. That run used the candidate builds of the four OpenHands images. The release builds differ from them only in the agent-server Go tool rebuilds and RootlessKit 3.3.0, plus the prod PostHog key in agent-canvas.Notes
alpine/psqlcommit (ce65a45) is the version tested and scanned above. Dropping it puts the postgres client back onpostgres:16.15-alpine, which has 1 / 24 fixable, all in the unusedgosu.ghcr.io/openhands/patched/agent-server@sha256:c143…published. Sandboxes created on 0.71.2 keep using that image when resumed after the upgrade.Upgrade notes for C3
helm upgradeprints a warning. Rolling back needs that backup.Testing
helm lintpasses,helm unittestpasses 169/169, andpytestgives 211 passed and 4 skipped locally. The 5 collection errors are modules missing from the local environment; CI'stest-scriptspasses.helm templatewith C3's values resolves enterprise-server, runtime-api and agent-server to the release digests above.postgres:13andpostgres:18over TLS.🤖 Generated with Claude Code