fix(docker): pin bcrypt below 5 so passlib can hash - #4182
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Team Run ID: 📒 Files selected for processing (3)
Included review availability: Your plan provides up to 10 included reviews per hour; 9 remain after this review. 📝 WalkthroughWalkthroughThe Docker job, runner, and server images now constrain Changesbcrypt compatibility
Estimated code review effort: 1 (Trivial) | ~5 minutes Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Full details: Linked Issues checkExplanation The pull request fully satisfies the requirements from linked issue Full details: Out of Scope Changes checkExplanation All changes in the pull request are in scope. The modifications are limited to three Dockerfile objects (deployment/docker/server/Dockerfile, deployment/docker/runner/Dockerfile, deployment/docker/job/Dockerfile) and consist only of adding the bcrypt version constraint and explanatory comments. These changes directly correspond to the issue requirement to pin bcrypt below version 5 in the official Docker images. No unrelated modifications are present. Full details: Docstring CoverageExplanation No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (3 skipped: 3 unsupported.) ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Hi @official-burak thank you for your contribution. But we need some test for this case. I will think how we can do this. UPDATE: Could you provide a playbook to reproduce the issue? |
|
Sure. This is enough to hit it inside the current Docker ansible venv: - hosts: localhost
connection: local
gather_facts: false
tasks:
- debug:
msg: "{{ 'test' | password_hash('bcrypt') }}"With passlib 1.7.4 + bcrypt 5 you get the 72-byte wraparound error on that four-byte password. |
There was a problem hiding this comment.
🟢 Approval recommended
The compatible constraint is correctly and consistently applied to every Docker image that installs passlib.
Pull request overview
Pins Python bcrypt below v5 across Docker images to restore passlib bcrypt hashing compatibility.
Changes:
- Adds
bcrypt>=4,<5beside passlib. - Documents the bcrypt 5 incompatibility.
File summaries
| File | Description |
|---|---|
deployment/docker/server/Dockerfile |
Pins bcrypt in the server image. |
deployment/docker/runner/Dockerfile |
Pins bcrypt in the runner image. |
deployment/docker/job/Dockerfile |
Pins bcrypt in the job image. |
Review details
- Files reviewed: 3/3 changed files
- Comments generated: 0
- Review effort level: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Fixes #4180.
bcrypt 5 makes passlib 1.7.4 fail its wraparound self-test, so
password_hash('bcrypt')errors in the Docker image even for short passwords. This pinsbcrypt>=4,<5next to passlib in the server, runner, and job images, matching the ansible-core advice.Confirmed locally: passlib 1.7.4 + bcrypt 5.0.0 raises the 72-byte error; bcrypt 4.x hashes fine.