[moshemorad]

Summary

Fixes the open Vanta findings for robusta (dependabot and the robusta-runner image) due by 2026-11-27, part of ROB-1738.

Package	From	To	CVEs
pillow	12.3.0	13.0.0	CVE-2026-112390..112406, 112892..112902, 96637..96778, GHSA-78g4-xqwv-q3g8 (3 critical, rest high)
filelock	3.29.4	4.2.4	CVE-2026-112940
h2	4.3.0	4.4.1	CVE-2026-71554 (medium, due 2026-11-06)
virtualenv	21.14.5	21.15.1	CVE-2026-113718, 113722, 113723, 113725
black (dev)	26.3.1	26.10.1	CVE-2026-114134
certifi	2026.4.22	2026.10.23	GHSA-6q48-6c7w-9gw2 (critical)

pyjwt, anyio and urllib3 were already at the fixed versions in the lock file.

Things reviewers should know

• Python floor moves from 3.10 to 3.11. Pillow 13 and filelock 4.x need 3.11. Keeping a 3.10 fallback would leave the vulnerable Pillow 12.3 and filelock 4.1 in poetry.lock, so dependabot and Trivy would keep flagging them. The image, test_robusta.yaml and the release workflow already run 3.11.
• prometrix 0.2.11 → 0.2.12 and prometheus-api-client 0.5.4 → 0.7.2. prometrix 0.2.11 caps pillow<13; 0.2.12 drops the cap but needs prometheus-api-client 0.7. That release no longer pulls pandas, numpy, matplotlib, httmock or tomli. The repo only imports PrometheusApiClientException from it.

Verification

• Trivy fs (HIGH,CRITICAL): 35 findings on master, 1 after. The one left is oauthlib CVE-2026-49272, not in the work list.
• Image build from the Dockerfile succeeds. Trivy on the built image shows no Pillow, pyjwt, virtualenv, filelock, h2, certifi or anyio findings, and import robusta.runner.main works in it.
• pytest tests (PYTHONPATH=src:playbooks): 450 passed, 19 failed, 1 error. Every failure is a "connection refused" to a Kubernetes API (tests/test_scope_matching.py, test_discovery_recovery_on_failure, test_upload, test_kind_cluster); this sandbox has no cluster. CI runs them against KIND.
• Not tested: arm64 image, helm golden tests, anything that needs a cluster, the Pillow 13 use in MS Teams PNG to JPEG conversion beyond import, and the registry scan of a PR image (no registry key in this environment).

Out of scope

• pip vendors urllib3 2.7.0 and msgpack 1.1.2 (CVE-2026-97687/97689, CVE-2026-114613, GHSA-6v7p-g79w-8964). src/robusta/runner/config_loader.py runs pip install at runtime for custom playbooks, so pip stays; pip 26.2.2 is the latest and still ships them.
• Debian packages (perl, curl, openssh, util-linux, ncurses, systemd, acl and others) have no fixed trixie or forky version yet.
• oauthlib CVE-2026-49272 (fix needs 4.0.0) and the Go stdlib 1.26.9 finding in the kubectl binary are not in the work list.

---

Generated by Claude Code

[github-actions]

✅ Docker image ready for 434fdf4 (built in 2m 57s)

• us-central1-docker.pkg.dev/robusta-development/temporary-builds/robusta-runner:434fdf4

⚠️ Warning: does not support ARM (ARM images are built on release only - not on every PR)

Use this tag to pull the image for testing.

📋 Copy commands

⚠️ Temporary images are deleted after 30 days. Copy to a permanent registry before using them:

gcloud auth configure-docker us-central1-docker.pkg.dev
docker pull us-central1-docker.pkg.dev/robusta-development/temporary-builds/robusta-runner:434fdf4
docker tag us-central1-docker.pkg.dev/robusta-development/temporary-builds/robusta-runner:434fdf4 me-west1-docker.pkg.dev/robusta-development/development/robusta-runner-dev:434fdf4
docker push me-west1-docker.pkg.dev/robusta-development/development/robusta-runner-dev:434fdf4

Patch Helm values in one line:

helm upgrade --install robusta robusta/robusta \
  --reuse-values \
  --set runner.image=me-west1-docker.pkg.dev/robusta-development/development/robusta-runner-dev:434fdf4

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Essentials
• Run ID: c1757bfc-c8be-4994-a452-6547fd7a0593

Commits

Reviewing files that changed from the base of the PR and between ebb6267 and a17cf2b.

Files ignored due to path filters: 1

• poetry.lock is excluded by !**/*.lock

Files selected for processing: 1

• pyproject.toml

Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 7 remain after this review.

Walkthrough

The project now requires Python 3.11 and updates constraints for selected runtime dependencies and the Black development dependency.

Changes

Python and dependency updates

Layer / File(s)	Summary
Python support and runtime constraints pyproject.toml	The supported Python range changes to >=3.11, <3.12. Constraints for prometrix, prometheus-api-client, certifi, h2, filelock, virtualenv, and Pillow change. Comments are updated with dependency and CVE details.
Black development constraint pyproject.toml	The Black version changes from 26.3.1 to 26.10.1, with a CVE comment added.

Priority: Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Other

Suggested reviewers: avi-robusta, roiglinik, naomi-robusta

Merge Risk: Minimal · up to a17cf

No actionable merge-blocking risk was identified in the dependency and Python constraint updates.

Pre-merge checks: 5

Check name	Status	Explanation
Title check		The title clearly identifies the main change: fixing the listed dependency CVEs.
Description check		The description directly explains the dependency updates, Python version change, verification results, and out-of-scope findings.
Docstring Coverage		No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}