Agent (Python runtime): container base image blocking pre-push hooks

[scottschreckengaust]

Component

Agent (Python runtime)

Describe the bug

The bgagent-local:latest Docker image (based on python:3.13-slim / Debian 13.4 trixie) contains multiple HIGH and CRITICAL CVEs that cause the pre-push hook's grype scan (mise //agent:security) to fail, blocking normal git push operations.

Current state (2026-05-19)

Base image python:3.13-slim resolves to Debian 13.4 trixie (current stable). The same CVE profile exists on python:3.14-slim — upgrading Python version alone doesn't help since the underlying Debian packages are identical.

CVE inventory

Package	Installed	Fix version	CVE	Severity	Fixable?
libc6 / libc-bin	2.41-12+deb13u2	2.41-12+deb13u3	CVE-2026-4437	High	Yes
libc6 / libc-bin	2.41-12+deb13u2	2.41-12+deb13u3	CVE-2026-4046	High	Yes
libcap2	1:2.75-10+b8	1:2.75-10+deb13u1	CVE-2026-4878	High	Yes
libc6 / libc-bin	2.41-12+deb13u2	(won't fix)	CVE-2026-5450	Critical	No
libc6 / libc-bin	2.41-12+deb13u2	(won't fix)	CVE-2026-5928	High	No
libc6 / libc-bin	2.41-12+deb13u2	(won't fix)	CVE-2026-5435	High	No
ncurses (4 pkgs)	6.5+20250216-2	(won't fix)	CVE-2025-69720	High	No
python (binary)	3.13.13	—	CVE-2026-6100	Critical	No (awaits CPython release)
python (binary)	3.13.13	—	CVE-2026-7210	Critical	No (awaits CPython release)
python (binary)	3.13.13	—	CVE-2026-4786	High	No (awaits CPython release)
python (binary)	3.13.13	—	CVE-2026-3298	High	No (awaits CPython release)

Impact

Blocks all git push without --no-verify, affecting developer workflow for all PRs.

Fix plan (bite-sized PRs)

PR 1: Pin python:3.14-slim-trixie + apt-get upgrade (~15 min review)

• Pin base image tag explicitly: python:3.14-slim-trixie (reproducible builds)
• Add apt-get upgrade -y in Dockerfile to pick up available security patches
• Fixes: CVE-2026-4437, CVE-2026-4046, CVE-2026-4878 (5 findings across libc6/libc-bin/libcap2)
• Validate: grype bgagent-local:latest --fail-on critical passes (no more fixable HIGHs in base)

PR 2: .grype.yaml suppressions with metadata (~10 min review)

• Add .grype.yaml at agent/ with per-CVE ignore entries for won't fix vulnerabilities
• Each entry documents: CVE, package, justification, review-after date
• Update mise //agent:security to reference the ignore file
• Pre-push hook passes without --no-verify

Acceptance criteria

• git push passes without --no-verify
• All suppressions are documented with justification
• Fixable CVEs are actually fixed (not suppressed)
• won't fix CVEs have review-after dates for lifecycle tracking

Related

• chore(agent): upgrade Debian base from bookworm to trixie #106 — closed (base already on trixie; subsumed by this issue)
• RFC: Automated toolchain version monitoring and upgrade workflow #104 — CVE lifecycle automation (scheduled re-scan of suppressions)
• Refresh agent container base image for outstanding HIGH CVEs (libngtcp2, gh) #60 — prior CVE fix (closed, different set)
• PR chore(agent): upgrade runtime deps — Node 24, Claude SDK 0.2.82, pin all Python deps #103 — Node 24 upgrade (merged, included runtime dep pins)