fix(security): update runtime certificate trust in v0.10.x

.devcontainer/devcontainer.json

@@ -4,8 +4,8 @@
     "dockerfile": "Dockerfile",
     "args": {
       "TOOLS_GO_VERSION": "1.26.10",
-      "TOOLS_NODE_VERSION": "24.13.0",
-      "TOOLS_UV_VERSION": "0.10.4",
+      "TOOLS_NODE_VERSION": "24.22.1",
+      "TOOLS_UV_VERSION": "0.13.5",
       "TOOLS_K9S_VERSION": "0.50.4",
       "TOOLS_KIND_VERSION": "0.27.0",
       "TOOLS_ISTIO_VERSION": "1.26.0",

Makefile

@@ -96,7 +96,7 @@ LDFLAGS := -X github.com/$(DOCKER_REPO)/go/core/internal/version.Version=$(VERSI
            -X github.com/$(DOCKER_REPO)/go/core/internal/version.BuildDate=$(BUILD_DATE)
 
 #tools versions
-TOOLS_UV_VERSION ?= 0.10.4
+TOOLS_UV_VERSION ?= 0.13.5
 TOOLS_NODE_VERSION ?= 24
 TOOLS_PYTHON_VERSION ?= 3.13
 

docker/skills-init/Dockerfile

@@ -31,7 +31,7 @@ ARG PYTHON_GID=1001
 # git is invoked by skills-init via exec.Command with an argv vector — never
 # through a shell — so the only attack surface here is git itself. OCI fetch
 # uses the in-process go-containerregistry library, so krane and jq are gone.
-RUN apk upgrade --no-cache && apk add --no-cache git openssh-client ca-certificates
+RUN apk upgrade --no-cache && apk add --no-cache git openssh-client "ca-certificates>=20261020-r0"
 
 COPY --from=builder /skills-init /usr/local/bin/skills-init
 

go/Dockerfile

@@ -32,7 +32,7 @@ RUN --mount=type=cache,target=/root/go/pkg/mod,rw             \
 ### STAGE 2: final image
 # Use distroless as minimal base image to package the manager binary
 # Refer to https://github.com/GoogleContainerTools/distroless for more details
-FROM gcr.io/distroless/static:nonroot
+FROM gcr.io/distroless/static-debian13:nonroot@sha256:d62067879de890a1def9da0e7766b7d20810a5e5555cef8506b752437d7a3e88
 ARG TARGETPLATFORM
 
 WORKDIR /

go/Dockerfile.full

@@ -23,12 +23,12 @@ RUN --mount=type=cache,target=/root/go/pkg/mod,rw \
     CGO_ENABLED=0 GOOS=${TARGETOS:-linux} GOARCH=${TARGETARCH} go build -ldflags "$LDFLAGS" -o /app "$BUILD_PACKAGE"
 
 # sandbox-runtime produces architecture-independent JavaScript; build it natively to avoid QEMU.
-FROM --platform=$BUILDPLATFORM $BASE_IMAGE_REGISTRY/chainguard/wolfi-base:latest AS srt-builder
+FROM --platform=$BUILDPLATFORM $BASE_IMAGE_REGISTRY/chainguard/wolfi-base:latest@sha256:8509ee4351a2e501b7f98201f2e2642396e82020c61a589cacdcfe74b9de46c1 AS srt-builder
 ARG TOOLS_PYTHON_VERSION=3.13
 
 RUN --mount=type=cache,target=/var/cache/apk,rw \
     apk add --no-cache \
-    bash git ca-certificates nodejs npm node-gyp bubblewrap python-${TOOLS_PYTHON_VERSION} libstdc++
+    bash git "ca-certificates>=20260909-r3" nodejs npm node-gyp bubblewrap python-${TOOLS_PYTHON_VERSION} libstdc++
 
 # Keep the pinned sandbox-runtime revision, but replace its vulnerable locked package versions.
 # Both lodash-es and shell-quote are direct dependencies of sandbox-runtime, so pinning them
@@ -42,12 +42,12 @@ RUN --mount=type=cache,target=/root/.npm \
     npm run build && \
     npm prune --omit=dev
 
-FROM $BASE_IMAGE_REGISTRY/chainguard/wolfi-base:latest
+FROM $BASE_IMAGE_REGISTRY/chainguard/wolfi-base:latest@sha256:8509ee4351a2e501b7f98201f2e2642396e82020c61a589cacdcfe74b9de46c1
 ARG TOOLS_PYTHON_VERSION=3.13
 
 RUN --mount=type=cache,target=/var/cache/apk,rw \
     apk add --no-cache \
-    bash ca-certificates curl nodejs bubblewrap socat python-${TOOLS_PYTHON_VERSION} ripgrep libstdc++
+    bash "ca-certificates>=20260909-r3" curl nodejs bubblewrap socat python-${TOOLS_PYTHON_VERSION} ripgrep libstdc++
 
 RUN addgroup -g 1001 goagent && \
     adduser -u 1001 -G goagent -s /bin/bash -D goagent

python/Dockerfile

@@ -6,13 +6,14 @@ FROM ghcr.io/astral-sh/uv:${UV_VERSION} AS uv-bin
 ### STAGE 2: builder
 # Build the uv-managed standalone Python interpreter and the project venv. Nothing
 # from this stage ships except /python and the venv.
-FROM ${BASE_IMAGE_REGISTRY}/chainguard/wolfi-base:latest AS builder
+FROM ${BASE_IMAGE_REGISTRY}/chainguard/wolfi-base:latest@sha256:8509ee4351a2e501b7f98201f2e2642396e82020c61a589cacdcfe74b9de46c1 AS builder
 ARG TOOLS_PYTHON_VERSION=3.13
 
 ENV LANG=C.UTF-8
 ENV LC_ALL=C.UTF-8
 ENV PYTHONOPTIMIZE=2
 ENV PYTHONUNBUFFERED=1
+ENV GRPC_DEFAULT_SSL_ROOTS_FILE_PATH=/etc/ssl/certs/ca-certificates.crt
 
 # uv configuration: install a managed standalone Python under /python and a copy-mode venv
 # (no editable installs) so the final image is self-contained with no source tree dependency.
@@ -26,7 +27,7 @@ ENV UV_PROJECT_ENVIRONMENT=/.kagent/.venv
 ENV UV_PYTHON_INSTALL_DIR=/python
 ENV UV_PYTHON_PREFERENCE=only-managed
 
-RUN apk add --no-cache ca-certificates
+RUN apk add --no-cache "ca-certificates>=20260909-r3"
 
 COPY --from=uv-bin /uv /uvx /usr/local/bin/
 
@@ -75,17 +76,18 @@ RUN mkdir -p /staging/config
 ### STAGE 3: final
 # Agents that need in-container code execution / bash tools use the "full" image
 # (python/Dockerfile.full) instead.
-FROM ${BASE_IMAGE_REGISTRY}/chainguard/wolfi-base:latest
+FROM ${BASE_IMAGE_REGISTRY}/chainguard/wolfi-base:latest@sha256:8509ee4351a2e501b7f98201f2e2642396e82020c61a589cacdcfe74b9de46c1
 ARG VERSION
 
 # Shared libraries the venv's C extensions link against (libstdc++ for pyarrow and friends,
 # zlib for numpy). The standalone CPython build bundles its own sqlite, bz2, lzma and ffi.
 # tzdata backs zoneinfo lookups.
-RUN apk add --no-cache ca-certificates libstdc++ zlib tzdata
+RUN apk add --no-cache "ca-certificates>=20260909-r3" libstdc++ zlib tzdata
 
 ENV LANG=C.UTF-8
 ENV LC_ALL=C.UTF-8
 ENV PYTHONUNBUFFERED=1
+ENV GRPC_DEFAULT_SSL_ROOTS_FILE_PATH=/etc/ssl/certs/ca-certificates.crt
 ENV PATH="/.kagent/.venv/bin:$PATH"
 ENV VIRTUAL_ENV=/.kagent/.venv
 

python/Dockerfile.full

@@ -12,13 +12,14 @@ FROM ghcr.io/astral-sh/uv:${UV_VERSION} AS uv-bin
 ### STAGE 2: base os + sandbox runtime
 # The apk package name encodes the Node major, so the sandbox-runtime's node >= 20
 # requirement is pinned by the package rather than by the base image tag.
-FROM ${BASE_IMAGE_REGISTRY}/chainguard/wolfi-base:latest AS python-os
+FROM ${BASE_IMAGE_REGISTRY}/chainguard/wolfi-base:latest@sha256:8509ee4351a2e501b7f98201f2e2642396e82020c61a589cacdcfe74b9de46c1 AS python-os
 ARG TOOLS_PYTHON_VERSION=3.13
 
 ENV LANG=C.UTF-8
 ENV LC_ALL=C.UTF-8
 ENV PYTHONOPTIMIZE=2
 ENV PYTHONUNBUFFERED=1
+ENV GRPC_DEFAULT_SSL_ROOTS_FILE_PATH=/etc/ssl/certs/ca-certificates.crt
 
 # Optimize malloc for containerized Python workloads
 ENV MALLOC_TRIM_THRESHOLD_=262144
@@ -37,7 +38,7 @@ ENV UV_PYTHON_INSTALL_DIR=/python
 ENV UV_PYTHON_PREFERENCE=only-managed
 
 RUN apk add --no-cache \
-        curl openssl bash git ca-certificates tzdata \
+        curl openssl bash git "ca-certificates>=20260909-r3" tzdata \
         bubblewrap socat ripgrep \
         nodejs-26 npm
 

python/packages/kagent-adk/pyproject.toml

@@ -35,7 +35,7 @@ dependencies = [
   "filelock>=3.20.3",  # CVE-2025-68146, CVE-2026-22701: TOCTOU symlink race condition
   "python-multipart>=0.0.22",  # CVE-2026-24486: Arbitrary file write via path traversal
   "httpx-sse>=0.4.3",  # U+2028/U+2029 SSE line terminator fix (0.4.2) + performance regression fix (0.4.3)
-  "boto3>=1.28.57",
+  "boto3>=1.43.117",
   "ollama >=0.3.6",  # Ollama SDK
   "numpy>=2.2.6",
 ]

python/packages/kagent-core/pyproject.toml

@@ -9,6 +9,7 @@ description = "kagent common library for kagent python packages"
 readme = "README.md"
 requires-python = ">=3.11"
 dependencies = [
+  "certifi>=2026.10.19",
   "a2a-sdk[http-server]>=0.3.26",
   "opentelemetry-api>=1.38.0,<1.39.0",
   "opentelemetry-sdk>=1.38.0,<1.39.0",

python/pyproject.toml

@@ -11,6 +11,7 @@ dev = [
 
 [tool.uv]
 constraint-dependencies = [
+    "uv>=0.13.5",
     "aiohttp>=3.14.3",
     "cryptography>=50.0.0",
     "httplib2>=0.32.0",

python/samples/crewai/poem_flow/Dockerfile

@@ -3,7 +3,10 @@ ARG DOCKER_REGISTRY=ghcr.io
 ARG VERSION=latest
 # substrate's gVisor (ateom) checkpoint/restore segfaults processes linked against trixie's newer glibc
 # use bookworm to align with the kagent-adk runtime image
-FROM ghcr.io/astral-sh/uv:python3.13-bookworm-slim
+FROM python:3.13.17-slim-bookworm@sha256:e32be0e55814a08977501ca863271d9bd02443710db8f2afaf8372e2c4508530
+COPY --from=ghcr.io/astral-sh/uv:0.13.5 /uv /uvx /usr/local/bin/
+
+ENV GRPC_DEFAULT_SSL_ROOTS_FILE_PATH=/etc/ssl/certs/ca-certificates.crt
 
 WORKDIR /app
 

python/samples/crewai/research-crew/Dockerfile

@@ -3,7 +3,10 @@ ARG DOCKER_REGISTRY=ghcr.io
 ARG VERSION=latest
 # substrate's gVisor (ateom) checkpoint/restore segfaults processes linked against trixie's newer glibc
 # use bookworm to align with the kagent-adk runtime image
-FROM ghcr.io/astral-sh/uv:python3.13-bookworm-slim
+FROM python:3.13.17-slim-bookworm@sha256:e32be0e55814a08977501ca863271d9bd02443710db8f2afaf8372e2c4508530
+COPY --from=ghcr.io/astral-sh/uv:0.13.5 /uv /uvx /usr/local/bin/
+
+ENV GRPC_DEFAULT_SSL_ROOTS_FILE_PATH=/etc/ssl/certs/ca-certificates.crt
 
 WORKDIR /app
 

python/samples/langgraph/currency/Dockerfile

@@ -3,7 +3,10 @@ ARG DOCKER_REGISTRY=ghcr.io
 ARG VERSION=latest
 # substrate's gVisor (ateom) checkpoint/restore segfaults processes linked against trixie's newer glibc
 # use bookworm to align with the kagent-adk runtime image
-FROM ghcr.io/astral-sh/uv:python3.13-bookworm-slim
+FROM python:3.13.17-slim-bookworm@sha256:e32be0e55814a08977501ca863271d9bd02443710db8f2afaf8372e2c4508530
+COPY --from=ghcr.io/astral-sh/uv:0.13.5 /uv /uvx /usr/local/bin/
+
+ENV GRPC_DEFAULT_SSL_ROOTS_FILE_PATH=/etc/ssl/certs/ca-certificates.crt
 
 WORKDIR /app
 

python/samples/langgraph/hitl-tools/Dockerfile

@@ -3,7 +3,10 @@ ARG DOCKER_REGISTRY=ghcr.io
 ARG VERSION=latest
 # substrate's gVisor (ateom) checkpoint/restore segfaults processes linked against trixie's newer glibc
 # use bookworm to align with the kagent-adk runtime image
-FROM ghcr.io/astral-sh/uv:python3.13-bookworm-slim
+FROM python:3.13.17-slim-bookworm@sha256:e32be0e55814a08977501ca863271d9bd02443710db8f2afaf8372e2c4508530
+COPY --from=ghcr.io/astral-sh/uv:0.13.5 /uv /uvx /usr/local/bin/
+
+ENV GRPC_DEFAULT_SSL_ROOTS_FILE_PATH=/etc/ssl/certs/ca-certificates.crt
 
 WORKDIR /app
 

python/samples/langgraph/kebab/Dockerfile

@@ -3,7 +3,10 @@ ARG DOCKER_REGISTRY=ghcr.io
 ARG VERSION=latest
 # substrate's gVisor (ateom) checkpoint/restore segfaults processes linked against trixie's newer glibc
 # use bookworm to align with the kagent-adk runtime image
-FROM ghcr.io/astral-sh/uv:python3.13-bookworm-slim
+FROM python:3.13.17-slim-bookworm@sha256:e32be0e55814a08977501ca863271d9bd02443710db8f2afaf8372e2c4508530
+COPY --from=ghcr.io/astral-sh/uv:0.13.5 /uv /uvx /usr/local/bin/
+
+ENV GRPC_DEFAULT_SSL_ROOTS_FILE_PATH=/etc/ssl/certs/ca-certificates.crt
 
 WORKDIR /app
 

python/samples/openai/basic_agent/Dockerfile

@@ -1,5 +1,7 @@
 ### STAGE 1: base image
-FROM ghcr.io/astral-sh/uv:python3.13-trixie-slim
+FROM ghcr.io/astral-sh/uv:0.13.5-python3.13-trixie-slim
+
+ENV GRPC_DEFAULT_SSL_ROOTS_FILE_PATH=/etc/ssl/certs/ca-certificates.crt
 
 WORKDIR /app