fix(image): strip packaging tools for Trivy-clean GHCR (v2.2.2)

Merge PR #32

Author: fgapel

CHANGELOG.md

@@ -7,6 +7,15 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.2.2] - 2026-07-17
+
+### Security
+
+- Runtime image uninstalls `setuptools`, `wheel`, and `pip` after the hashed
+  requirement install so Trivy HIGH findings in setuptools-vendored
+  `jaraco.context` / `wheel` (CVE-2026-23949, CVE-2026-24049) cannot block GHCR
+  publication of an otherwise clean artifact.
+
 ## [2.2.1] - 2026-07-17
 
 ### Security

Dockerfile

@@ -21,9 +21,13 @@ RUN apk add --no-cache \
     nginx=1.30.3-r0 \
     pcre2=10.47-r1
 
-# Copy requirements and install
+# Copy requirements and install. Then strip packaging tooling that is only needed
+# to install wheels: setuptools/wheel/pip (and their vendored trees) are not used
+# by the runtime and have historically carried HIGH Trivy findings.
 COPY requirements.txt .
-RUN pip install --no-cache-dir --require-hashes --only-binary=:all: -r requirements.txt
+RUN pip install --no-cache-dir --require-hashes --only-binary=:all: -r requirements.txt \
+ && pip uninstall -y setuptools wheel pip \
+ && rm -rf /root/.cache /tmp/pip-*
 
 # Copy only runtime modules; tests, benchmarks, and operator helpers do not
 # belong in the published execution artifact.

VERSION

@@ -1 +1 @@
-2.2.1
+2.2.2

overlay/read.html

@@ -25,7 +25,7 @@
     <link rel="stylesheet" href="{{ url_for('static', filename='css/popup.css') }}">
     <link rel="stylesheet" href="{{ url_for('static', filename='css/reader.css') }}">
     <!-- book-translator: bilingual reading overlay -->
-    <link rel="stylesheet" href="{{ url_for('static', filename='css/translator.css') }}?v=2.2.1">
+    <link rel="stylesheet" href="{{ url_for('static', filename='css/translator.css') }}?v=2.2.2">
     <script>
         // book-translator configuration.
         // This legacy bind-mount template is HTTP-only as shipped: an empty
@@ -269,6 +269,6 @@ <h3>{{_('Settings')}}</h3>
       <script src="{{ url_for('static', filename='js/reading/epub.js') }}"></script>
       <script src="{{ url_for('static', filename='js/reading/epub-progress.js') }}"></script>      
       <!-- book-translator: bilingual translation injection -->
-      <script src="{{ url_for('static', filename='js/translator.js') }}?v=2.2.1"></script>
+      <script src="{{ url_for('static', filename='js/translator.js') }}?v=2.2.2"></script>
     </body>
 </html>

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "cwa-ebook-translate-plugin",
-  "version": "2.2.1",
+  "version": "2.2.2",
   "description": "Bilingual LLM-powered translation overlay for Calibre-Web-Automated. Translate ebooks paragraph-by-paragraph while reading, in 100+ languages, using local LLMs (Gemma 4 via vLLM/LM Studio/Ollama) or any major cloud API.",
   "main": "test_frontend.js",
   "directories": {

package.json

@@ -5,7 +5,7 @@
 (function () {
     'use strict';
     // ── Version & Telemetry ──────────────────────────────────────────
-    const BT_UI_VERSION = '2.2.1';
+    const BT_UI_VERSION = '2.2.2';
     console.log(`[BookTranslator] loaded version ${BT_UI_VERSION}`);
     const cfg = (typeof window !== 'undefined' && window.BOOK_TRANSLATOR) || {};
     const configuredAuthMode = cfg.authMode || (cfg.apiToken ? 'token' : 'cwa_session');

static/translator.js

@@ -216,6 +216,8 @@ def test_python_installs_require_the_reviewed_hashes_and_wheels(self):
             "--only-binary=:all: -r requirements.txt",
             dockerfile,
         )
+        # Runtime image must not retain packaging tooling after install (Trivy).
+        self.assertIn("pip uninstall -y setuptools wheel pip", dockerfile)
 
     def test_python_lock_files_pin_and_hash_every_dependency(self):
         for name in (