[rhoai-3.3] RHAIENG-4687: fix(cve): CVE-2026-28684 python-dotenv by mtchoum1 · Pull Request #2696 · red-hat-data-services/notebooks

mtchoum1 · 2026-08-03T19:55:24Z

Summary

Bumps python-dotenv from 1.2.1 to 1.2.2 to fix CVE-2026-28684 (symlink following in set_key allows arbitrary file overwrite via cross-device rename fallback)
Adds constraint python-dotenv>=1.2.2 to dependencies/cve-constraints.txt
Regenerates pylock.toml files for all affected images

CVE Details

Field	Value
CVE ID	CVE-2026-28684
Package	python-dotenv
Severity	Medium (CVSS 6.6)
Fix Version	>= 1.2.2
Jira	RHAIENG-4687
Advisory	GHSA-mf9w-mj56-hr94

Test plan

Konflux builds pass for affected images
python-dotenv version in built images is >= 1.2.2
No dependency conflicts introduced

Summary by CodeRabbit

Security
- Added a minimum supported version of python-dotenv to address a reported security vulnerability.
- Improved protection for applications using affected Python environments.
Maintenance
- Updated python-dotenv from version 1.2.1 to 1.2.2 across supported Python runtime environments.
- Refreshed package integrity metadata for the updated release.
- Applied the update consistently across data science, PyTorch, ROCm PyTorch, and TensorFlow environments.

…tenv to 1.2.2 Bump python-dotenv from 1.2.1 to 1.2.2 to fix CVE-2026-28684 (symlink following in set_key allows arbitrary file overwrite). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

github-actions · 2026-08-03T19:55:57Z

Superseded by newer run: https://github.com/red-hat-data-services/notebooks/actions/runs/30847885191

CI status [antigravity]

Run: Build Notebooks (push) #30847875153 — 3/3 complete · 3 skipped
Last updated: 2026-08-03T19:55:51Z

No workbench image jobs ran; all matrix jobs were skipped.

coderabbitai · 2026-08-03T19:56:25Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 99fb3ec6-a657-41cd-aab6-5495d53247c8

📥 Commits

Reviewing files that changed from the base of the PR and between a90eed3 and 246f631.

📒 Files selected for processing (6)

dependencies/cve-constraints.txt
jupyter/datascience/ubi9-python-3.12/pylock.toml
runtimes/datascience/ubi9-python-3.12/pylock.toml
runtimes/pytorch/ubi9-python-3.12/pylock.toml
runtimes/rocm-pytorch/ubi9-python-3.12/pylock.toml
runtimes/tensorflow/ubi9-python-3.12/pylock.toml

💤 Files with no reviewable changes (5)

runtimes/tensorflow/ubi9-python-3.12/pylock.toml
runtimes/pytorch/ubi9-python-3.12/pylock.toml
jupyter/datascience/ubi9-python-3.12/pylock.toml
runtimes/datascience/ubi9-python-3.12/pylock.toml
runtimes/rocm-pytorch/ubi9-python-3.12/pylock.toml

🚧 Files skipped from review as they are similar to previous changes (1)

dependencies/cve-constraints.txt

📝 Walkthrough

Walkthrough

The change adds a CVE-specific minimum version for python-dotenv and updates five Python 3.12 lockfiles from version 1.2.1 to 1.2.2, including artifact metadata and hashes.

Changes

python-dotenv CVE remediation

Layer / File(s)	Summary
Add the minimum version constraint `dependencies/cve-constraints.txt`	Adds `python-dotenv>=1.2.2` with a CVE-2026-28684 issue reference.
Refresh python-dotenv lock entries `jupyter/datascience/ubi9-python-3.12/pylock.toml`, `runtimes/*/ubi9-python-3.12/pylock.toml`	Updates `python-dotenv` from 1.2.1 to 1.2.2 and replaces source and wheel artifact metadata and hashes.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: ⚪ Minimal · up to 246f6

This change updates the affected Python dependency and lockfiles without any identified merge-blocking correctness, security, availability, or integration risk at the current head.

Suggested reviewers: jiridanek, atheo89

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description explains the CVE fix and affected files, but it omits the required template sections and provides no completed test results.	Add the required testing details and complete the self-checklist and merge-criteria checklist.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the CVE fix and the affected python-dotenv dependency.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch fix/cve-python-dotenv-rhoai-3.3

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-08-04T01:57:18Z

Superseded by newer run: https://github.com/red-hat-data-services/notebooks/actions/runs/31776535101

CI status [antigravity]

Run: Build Notebooks (pr) #30847885191 — 10/10 complete · 7 passed · 1 skipped · 2 cancelled
Last updated: 2026-08-04T01:57:09Z after workflow update completed

Failures so far

Job	Failed step	Link
jupyter-datascience-ubi9-python-3.12 · linux/ppc64le [rhoai] / build	Build: make jupyter-datascience-ubi9-python-3.12	logs
runtime-datascience-ubi9-python-3.12 · linux/s390x [rhoai] / build	Build: make runtime-datascience-ubi9-python-3.12	logs

Likely root causes

The workflow run was cancelled during build dependency installation for jupyter-datascience-ubi9-python-3.12 · linux/ppc64le [rhoai] / build and runtime-datascience-ubi9-python-3.12 · linux/s390x [rhoai] / build jobs.
The logs explicitly show ##[error]The operation was canceled., indicating manual or system-level cancellation rather than a code or dependency compilation failure.

Suggested next steps

Re-trigger the workflow to rerun the cancelled jobs.

jiridanek · 2026-08-04T06:54:10Z

@mtchoum1 "Code static analysis / check-generated-code (pull_request)" failing, same issue as what we discussed with Ayush last week; please fix that first

jiridanek · 2026-08-14T06:19:10Z

@coderabbitai resolve merge conflict

Please intelligently resolve the conflicts on this PR branch against rhoai-3.3 (now includes #2757). Prefer keeping this PR's intended CVE/fix changes while taking the base-branch Python 3.12 environment narrowing and related lockfile/constraint updates where they are the upstream fix.

coderabbitai · 2026-08-14T06:19:15Z

✅ Merge conflicts resolved successfully!

Resolved 6 conflict file(s). Commit: 767c1f92d3a97750bea10229f7558882bf828aa6 pushed to fix/cve-python-dotenv-rhoai-3.3.

6 file operation(s)

dependencies/cve-constraints.txt (update)
jupyter/datascience/ubi9-python-3.12/pylock.toml (update)
runtimes/datascience/ubi9-python-3.12/pylock.toml (update)
runtimes/pytorch/ubi9-python-3.12/pylock.toml (update)
runtimes/rocm-pytorch/ubi9-python-3.12/pylock.toml (update)
runtimes/tensorflow/ubi9-python-3.12/pylock.toml (update)

View agent analysis

Resolved conflicts in: - dependencies/cve-constraints.txt (content) - jupyter/datascience/ubi9-python-3.12/pylock.toml (content) - runtimes/datascience/ubi9-python-3.12/pylock.toml (content) - runtimes/pytorch/ubi9-python-3.12/pylock.toml (content) - runtimes/rocm-pytorch/ubi9-python-3.12/pylock.toml (content) - runtimes/tensorflow/ubi9-python-3.12/pylock.toml (content) Co-authored-by: CodeRabbit <noreply@coderabbit.ai>

github-actions · 2026-08-14T06:31:05Z

Superseded by newer run: https://github.com/red-hat-data-services/notebooks/actions/runs/31776538868

CI status [antigravity]

Run: Build Notebooks (push) #31776535101 — 3/3 complete · 3 skipped
Last updated: 2026-08-14T06:30:59Z

No workbench image jobs ran; all matrix jobs were skipped.

github-actions · 2026-08-14T12:32:28Z

Superseded by newer run: https://github.com/red-hat-data-services/notebooks/actions/runs/31809958888

CI status [antigravity]

Run: Build Notebooks (pr) #31776538868 — 10/10 complete · 7 passed · 1 skipped · 2 cancelled
Last updated: 2026-08-14T12:32:19Z after workflow update completed

Failures so far

Job	Failed step	Link
jupyter-datascience-ubi9-python-3.12 · linux/ppc64le [rhoai] / build	Build: make jupyter-datascience-ubi9-python-3.12	logs
runtime-datascience-ubi9-python-3.12 · linux/s390x [rhoai] / build	Build: make runtime-datascience-ubi9-python-3.12	logs

Likely root causes

Two build jobs (jupyter-datascience-ubi9-python-3.12 · linux/ppc64le [rhoai] / build and runtime-datascience-ubi9-python-3.12 · linux/s390x [rhoai] / build) were cancelled (The operation was canceled.), while other matrix jobs passed or were skipped.
There are no compilation or test failures reported in the error contexts or log excerpts; the jobs were terminated due to cancellation.

Suggested next steps

Re-run the cancelled workflow jobs to confirm if they pass successfully under normal execution.

github-actions · 2026-08-14T14:32:21Z

CI status [antigravity]

Run: Build Notebooks (push) #31809958888 — 3/3 complete · 3 skipped
Last updated: 2026-08-14T14:32:16Z

No workbench image jobs ran; all matrix jobs were skipped.

jiridanek · 2026-08-14T17:33:11Z

/build-konflux

openshift-ci · 2026-08-14T17:33:25Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jiridanek

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [jiridanek]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[rhoai-3.3] RHAIENG-4687: fix(cve): CVE-2026-28684 - update python-do…

a90eed3

…tenv to 1.2.2 Bump python-dotenv from 1.2.1 to 1.2.2 to fix CVE-2026-28684 (symlink following in set_key allows arbitrary file overwrite). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

openshift-ci Bot requested review from atheo89 and jiridanek August 3, 2026 19:55

github-actions Bot added the review-requested label Aug 3, 2026

openshift-ci Bot added the needs-rebase label Aug 14, 2026

openshift-ci Bot removed the needs-rebase label Aug 14, 2026

Merge branch 'rhoai-3.3' into fix/cve-python-dotenv-rhoai-3.3

246f631

jiridanek approved these changes Aug 14, 2026

View reviewed changes

openshift-ci Bot assigned jiridanek Aug 14, 2026

openshift-ci Bot added the lgtm label Aug 14, 2026

openshift-ci Bot added the approved label Aug 14, 2026

mtchoum1 merged commit 97296d3 into rhoai-3.3 Aug 14, 2026
40 of 59 checks passed

mtchoum1 deleted the fix/cve-python-dotenv-rhoai-3.3 branch August 14, 2026 17:55

jiridanek mentioned this pull request Aug 14, 2026

[rhoai-3.3] chore(cve): bump Python CVE floors for unassigned Notebooks trackers #2760

Merged

9 tasks

Navigation Menu

Uh oh!

[rhoai-3.3] RHAIENG-4687: fix(cve): CVE-2026-28684 python-dotenv - #2696

[rhoai-3.3] RHAIENG-4687: fix(cve): CVE-2026-28684 python-dotenv#2696
mtchoum1 merged 3 commits into
rhoai-3.3from
fix/cve-python-dotenv-rhoai-3.3

mtchoum1 commented Aug 3, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

github-actions Bot commented Aug 3, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Aug 3, 2026 •

edited

Loading

Walkthrough

Changes

❌ Failed checks (1 warning)

Uh oh!

github-actions Bot commented Aug 4, 2026 •

edited

Loading

Uh oh!

jiridanek commented Aug 4, 2026

Uh oh!

jiridanek commented Aug 14, 2026

Uh oh!

coderabbitai Bot commented Aug 14, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Aug 14, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Aug 14, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Aug 14, 2026

Uh oh!

jiridanek commented Aug 14, 2026

Uh oh!

openshift-ci Bot commented Aug 14, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

mtchoum1 commented Aug 3, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

CVE Details

Test plan

Summary by CodeRabbit

Uh oh!

github-actions Bot commented Aug 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

CI status [antigravity]

Uh oh!

coderabbitai Bot commented Aug 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

❌ Failed checks (1 warning)

Uh oh!

github-actions Bot commented Aug 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

CI status [antigravity]

Failures so far

Likely root causes

Suggested next steps

Uh oh!

jiridanek commented Aug 4, 2026

Uh oh!

jiridanek commented Aug 14, 2026

Uh oh!

coderabbitai Bot commented Aug 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

CI status [antigravity]

Uh oh!

github-actions Bot commented Aug 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

CI status [antigravity]

Failures so far

Likely root causes

Suggested next steps

Uh oh!

github-actions Bot commented Aug 14, 2026

CI status [antigravity]

Uh oh!

jiridanek commented Aug 14, 2026

Uh oh!

openshift-ci Bot commented Aug 14, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

mtchoum1 commented Aug 3, 2026 •

edited by coderabbitai Bot

Loading

github-actions Bot commented Aug 3, 2026 •

edited

Loading

coderabbitai Bot commented Aug 3, 2026 •

edited

Loading

github-actions Bot commented Aug 4, 2026 •

edited

Loading

coderabbitai Bot commented Aug 14, 2026 •

edited

Loading

github-actions Bot commented Aug 14, 2026 •

edited

Loading

github-actions Bot commented Aug 14, 2026 •

edited

Loading