resolve Trivy HIGH/MEDIUM CVEs via dnf update and patroni on python3.12

[maqeel75]

Remediates all Trivy CRITICAL/HIGH/MEDIUM findings in the pgedge-postgres images. The findings split into two root causes, each fixed in the shared Dockerfile:

1. Stale OS packages — the base/install layers shipped Rocky 9.8 packages predating the latest errata (acl/libacl, giflib, glib2, glibc*, libsolv, libtiff*, python3*). Added dnf update -y to both the minimal and standard stages so every
   installed package (including transitive deps) is patched to current errata.
2. Patroni's Python HTTP deps — urllib3 and requests (installed via pip install patroni) were stuck at vulnerable versions because their fixes require Python ≥ 3.10, while the system python3 is 3.9. Patroni is now installed under python3.12
   (from Rocky AppStream), which pulls patched urllib3 2.7.0 and requests 2.34.2. The psycopg3 extra is added so patroni bundles its own libpq-backed driver instead of relying on the Python 3.9-only system psycopg2.

Verification
All three images rebuilt from the branch (no-cache, arm64) rescanned 0 CRITICAL / 0 HIGH / 0 MEDIUM (pg16, pg17, pg18), and pg18 passed 21/21 tests including the Patroni-under-python3.12 entrypoint test.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 55030f35-c5ab-4857-ab80-6ef45a01bacd

📥 Commits

Reviewing files that changed from the base of the PR and between 502f10d and 0a1fdf7.

📒 Files selected for processing (1)

• Dockerfile

🚧 Files skipped from review as they are similar to previous changes (1)

• Dockerfile

---

📝 Walkthrough

Walkthrough

The container builds now apply current OS updates in both image variants, install Patroni with Python 3.12 and pinned dependency floors in the standard variant, and explicitly declare that no Trivy vulnerability suppressions are configured.

Changes

Container build updates

Layer / File(s)	Summary
OS patching and vulnerability policy .trivy/pgedge-postgres.trivyignore.yaml, Dockerfile	The minimal image applies dnf update -y after package installation, while Trivy is configured with an empty vulnerability suppression list.
Python 3.12 Patroni installation Dockerfile	The standard image installs Python 3.12 and pip, then installs pinned Patroni 4.1.3 with etcd, jsonlogger, and psycopg3 extras plus urllib3 and requests version floors before removing pip.

Poem

A rabbit checks the image with care,
Fresh patches hop through every layer.
Patroni wears a Python-new coat,
No ignored flaws remain afloat.
“Build clean!” I thump the lair.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately summarizes the main Dockerfile changes: OS updates and Patroni moving to Python 3.12 to address CVEs.
Description check	✅ Passed	The description matches the changeset and explains the dnf updates and Patroni/Python 3.12 remediation strategy.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch trivy-scan-fixes

---

_{Comment @coderabbitai help to get the list of available commands.}

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[coderabbitai]

Actionable comments posted: 1

🧹 Nitpick comments (1)

Dockerfile (1)

126-127: 🚀 Performance & Scalability | 🔵 Trivial | ⚡ Quick win

Avoid retaining pip’s cache in the final image.

pip caches downloaded responses and wheels by default; removing python3.12-pip does not remove /root/.cache/pip. Use --no-cache-dir during installation or purge the cache before removing pip. (pip.pypa.io)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@Dockerfile` around lines 126 - 127, Update the Patroni installation command
in the Dockerfile to disable pip’s cache using the appropriate pip option,
ensuring no downloaded responses or wheels remain in the final image before
python3.12-pip is removed.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@Dockerfile`:
- Around line 119-126: Update the Patroni installation command to explicitly
require urllib3>=2.7.0 and requests>=2.33.0 alongside
patroni[etcd,jsonlogger,psycopg3]==4.1.3, or add an equivalent build-time
version assertion so these CVE-fixing floors are enforced.

---

Nitpick comments:
In `@Dockerfile`:
- Around line 126-127: Update the Patroni installation command in the Dockerfile
to disable pip’s cache using the appropriate pip option, ensuring no downloaded
responses or wheels remain in the final image before python3.12-pip is removed.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: a1b9ef0c-56a1-4a0e-b17c-1d7a37e7c521

📥 Commits

Reviewing files that changed from the base of the PR and between 3069d98 and 502f10d.

📒 Files selected for processing (2)

• .trivy/pgedge-postgres.trivyignore.yaml
• Dockerfile