diff --git a/Dockerfile b/Dockerfile index 2e0aae772..4525ceed2 100644 --- a/Dockerfile +++ b/Dockerfile @@ -10,8 +10,7 @@ ADD . /logprep WORKDIR /logprep RUN curl https://sh.rustup.rs -sSf | bash -s -- -y ENV PATH="/root/.cargo/bin:${PATH}" -RUN python -m pip install --upgrade pip wheel setuptools>=72.2.0 -RUN python -m venv /opt/venv +RUN python -m venv --without-pip /opt/venv # Make sure we use the virtualenv: ENV PATH="/opt/venv/bin:$PATH" @@ -20,6 +19,10 @@ RUN if [ "$LOGPREP_VERSION" = "dev" ]; then pip install .;\ else pip install "logprep==$LOGPREP_VERSION"; fi; \ logprep --version +# geoip2 4.8.0 lists a vulnerable setuptools version as a dependency. setuptools is unneeded at runtime, so it is uninstalled. +# More recent (currently unreleased) versions of geoip2 removed setuptools from dependencies. +RUN pip uninstall -y setuptools + FROM bitnami/python:${PYTHON_VERSION} as prod ARG http_proxy diff --git a/pyproject.toml b/pyproject.toml index f15f330b4..a07259653 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -85,7 +85,6 @@ dependencies = [ "urlextract", "urllib3>=1.26.17", # CVE-2023-43804 "uvicorn", - "wheel", "deepdiff", "msgspec", "boto3",