main -> stable - #3230

Verify each finding against the current code and only fix it if needed.

Inline comments:
In
@.tekton/odh-workbench-jupyter-datascience-cpu-py312-ubi9-odh-main-pull-request.yaml:
- Line 16: The CEL filter in the PR trigger is missing the shared meta-project
paths used by the datascience image; update the condition inside
".tekton/odh-workbench-jupyter-datascience-cpu-py312-ubi9-odh-main-pull-request.yaml"
so the OR list includes .pathChanged() checks for the three new projects:
"dependencies/odh-notebooks-meta-db-connectors-deps",
"dependencies/odh-notebooks-meta-jupyterlab-deps", and
"dependencies/odh-notebooks-meta-jupyterlab-datascience-deps" (add each as e.g.
"dependencies/odh-notebooks-meta-db-connectors-deps".pathChanged()) so a PR
touching any of those shared inputs will trigger the PipelineRun.

In @.tekton/odh-workbench-jupyter-datascience-cpu-py312-ubi9-odh-main-push.yaml:
- Line 11: The trigger's CEL expression for
pipelinesascode.tekton.dev/on-cel-expression omits the shared meta-project
directories that now affect jupyter/datascience/ubi9-python-3.12/pyproject.toml,
so add OR conditions to the existing pathChanged() list to include the
dependency projects (e.g.,
"dependencies/odh-notebooks-meta-db-connectors-deps".pathChanged(),
"dependencies/odh-notebooks-meta-jupyterlab-deps".pathChanged(), and
"dependencies/odh-notebooks-meta-jupyterlab-datascience-deps".pathChanged()) so
changes in those shared projects will also cause the PipelineRun to execute;
update the expression that currently lists the
jupyter/datascience/ubi9-python-3.12/** paths under the same OR group.

In `@jupyter/datascience/ubi9-python-3.12/Dockerfile.cpu`:
- Around line 52-53: The RUN command that imports the CentOS GPG key ("RUN rpm
--import /cachi2/output/deps/generic/RPM-GPG-KEY-CentOS-Official || true") is
silencing failures with "|| true"; remove the silent suppression and instead
ensure the build fails or logs a clear warning when the key is missing or
invalid. Replace the silent suppression by checking the key import result for
the "rpm --import /cachi2/output/deps/generic/RPM-GPG-KEY-CentOS-Official" step
(or test for file existence first) and emit a descriptive error/warning or exit
non‑zero so unsigned packages are not allowed; keep the second import ("RUN rpm
--import /etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release") consistent with this
behavior.

In `@jupyter/datascience/ubi9-python-3.12/uv.lock.d/pylock.cpu.toml`:
- Around line 1874-1883: The "uv" package entry declares a broad marker
(implementation_name == 'cpython' and sys_platform == 'linux') but only supplies
wheels for linux_aarch64, linux_s390x and linux_x86_64; narrow the marker for
the uv package or add the missing ppc64le wheel: either change the uv
[[packages]] marker to explicitly restrict architectures (e.g. include
platform_machine in ("x86_64","aarch64","s390x")) so the resolver won't attempt
ppc64le, or add a wheels entry for linux_ppc64le with the correct URL,
upload-time, size and sha256 hash to match the other wheel entries. Ensure you
update the package block for name = "uv" and its wheels list accordingly.

In `@jupyter/minimal/ubi9-python-3.12/prefetch-input/odh/rpms.lock.yaml`:
- Around line 1428-1434: The python3-pip entry (name: python3-pip, evr:
21.3.1-1.el9) in the rpms.lock.yaml is vulnerable to CVE-2023-5752 for Mercurial
(hg+) installs; verify whether your build or downstreams actually perform
Mercurial VCS installs and, if they do, either (a) replace or override this
package with a non-vulnerable pip (version >=23.3 or vendor-supplied RHEL
backport when available) or (b) document and mitigate the risk by disabling VCS
installs or blocking hg+ URLs in your pipelines; update the lock entry or add a
clear comment/mitigation note referencing python3-pip 21.3.1 and CVE-2023-5752
accordingly.

In `@jupyter/minimal/ubi9-python-3.12/prefetch-input/rhds/rpms.in.yaml`:
- Line 43: The shared RPM manifest currently lists compiler and -devel packages
(e.g., unixODBC-devel) and an s390x toolchain block; remove those entries from
this shared runtime manifest and place them into an s390x-only builder manifest
or a dedicated build-stage manifest so they are only installed for the s390x
builder path; update the manifests referenced around the same section (also
applies to the package group in lines ~91-102) to ensure minimal runtime images
no longer include compilers/headers.

In `@jupyter/minimal/ubi9-python-3.12/prefetch-input/rhds/rpms.lock.yaml`:
- Around line 56-57: The lockfile rpms.lock.yaml contains many entries where the
URL architecture (e.g., "aarch64", "ppc64le", "s390x") does not match the
hardcoded repoid value "rhel-9-for-x86_64-appstream-rpms"; regenerate the
lockfile or update the repoid fields so each package entry's repoid corresponds
to the URL architecture (or remove repoid entirely if your consumer resolves
strictly from URL). Locate and fix the repoid key entries (search for "repoid"
and sample URLs like the autoconf URL) so that for each architecture block you
set the correct repository id (e.g., rhel-9-for-aarch64-appstream-rpms,
rhel-9-for-ppc64le-appstream-rpms, rhel-9-for-s390x-appstream-rpms) or strip
repoid generation in the producing script to avoid mismatches.
- Around line 17547-17560: The lockfile pins unversioned RHEL 9 Python packages
(entries named python3-devel and python3-pip with sourcerpm python3.9-...) into
the ubi9-python-3.12 variant; update the rpms.lock.yaml entries so they
reference version-matched Python 3.12 RPMs (e.g., replace
python3-devel/python3-pip entries whose sourcerpm starts with "python3.9-" or
"python-pip-" with the corresponding python3.12-devel/python3.12-pip RPMs and
correct repoid/checksum/evr), or remove them if they are only transitive
artifacts and must not be installed; after changing the lockfile, re-run the
provided verification script and grep the manifests/Dockerfiles (e.g.,
odh/rpms.in.yaml, Dockerfile.cpu, Dockerfile.konflux.cpu) to ensure no
references remain to python3-devel -> python3.9 or unversioned python3-pip so
native extensions will use Python 3.12 headers.

In `@jupyter/pytorch`+llmcompressor/ubi9-python-3.12/uv.lock.d/pylock.cuda.toml:
- Line 2: The lock-generation command uses the flag
--index-strategy=unsafe-best-match which can cause cross-index package selection
when mixing CUDA and CPU indexes; update the invocation that builds
uv.lock.d/pylock.cuda.toml to use --index-strategy=first-index (or alternatively
split CUDA/CPU index sets) so the resolver prefers the primary CUDA index
deterministically; locate the command string containing
--index-strategy=unsafe-best-match and replace it with
--index-strategy=first-index in the pylock generation invocation.

In `@jupyter/rocm/pytorch/ubi9-python-3.12/uv.lock.d/pylock.rocm.toml`:
- Line 2: The commented pip-compile command in pylock.rocm.toml uses
--index-strategy=unsafe-best-match which enables cross-index version selection;
update that flag to --index-strategy=first-index in the commented command (the
long uv pip compile invocation) so the resolver uses the first index containing
a package instead of unsafe-best-match.

In `@tests/browser/tests/openshift_console.spec.ts`:
- Around line 14-16: The call to customApi.getNamespacedCustomObject is using an
options object but the `@kubernetes/client-node` API expects positional arguments;
update the invocation of getNamespacedCustomObject (where route is assigned) to
pass the five parameters in order: group, version, namespace, plural, name
(i.e., 'route.openshift.io', 'v1', 'openshift-console', 'routes', 'console')
instead of the object form so the function signature matches the client library.

In `@tests/browser/tsconfig.json`:
- Line 4: The tsconfig setting "target": "es2025" is incompatible with the
Playwright/base Node.js 22 runtime; update the tsconfig.json target to "es2024"
(replace the "target": "es2025" entry) so TypeScript type-checks against the
actual runtime, or alternatively update the CI/Playwright base image to one that
includes Node.js 24+; edit the "target" field in tests/browser/tsconfig.json
(the "target" property) to ensure it matches the chosen runtime.

---

Outside diff comments:
In `@jupyter/pytorch`+llmcompressor/ubi9-python-3.12/Dockerfile.konflux.cuda:
- Around line 191-196: The pip install invocation using the UV wrapper (the
command starting with "UV_NO_CACHE=true UV_LINK_MODE=copy
UV_PREVIEW_FEATURES=pylock uv pip install ... --no-verify-hashes") disables
package hash verification; either enable strict hash checking by replacing
"--no-verify-hashes" with "--require-hashes" (and ensure ./requirements.txt /
pylock.toml contains hashes) or, if Cachi2 prefetching prevents exact hashes,
add a clear comment above this UV pip install line explaining why hashes are
intentionally omitted (describe the Cachi2 renaming/reprocessing behavior) so
future maintainers understand the tradeoff.

In `@runtimes/datascience/ubi9-python-3.12/Dockerfile.konflux.cpu`:
- Around line 123-124: The Dockerfile currently fetches the Elyra bootstrapper
at build time via the RUN curl line (downloading bootstrapper.py), which
violates hermetic build rules; replace that network fetch by vendoring or
prefetching the file into the build context and change the Dockerfile to use
COPY/ADD to bring ./utils/bootstrapper.py into the image instead of the curl
command. Ensure the repository contains the exact bootstrapper.py (or a pinned
vendor snapshot) and update the Dockerfile location that referenced the
bootstrapper (the RUN curl line) to a COPY ./utils/bootstrapper.py
./utils/bootstrapper.py so the image build no longer requires external network
access.
- Around line 97-101: The Dockerfile currently fetches the OpenShift client with
the curl/tar sequence (curl ... -o /tmp/openshift-client-linux.tar.gz; tar -xzvf
/tmp/openshift-client-linux.tar.gz; rm -f /tmp/openshift-client-linux.tar.gz),
which breaks hermetic builds; replace that block by installing the prefetched
openshift-clients RPM (package name openshift-clients) via dnf (e.g., dnf
install -y /path/to/prefetched/openshift-clients-*.rpm or dnf install -y
openshift-clients if the manifests repo is enabled) and remove the curl/tar
lines so the Dockerfile uses the pre-fetched RPM artifact instead of downloading
from mirror.openshift.com.

In `@tests/browser/tests/utils.ts`:
- Around line 31-45: The loop inside the Promise schedules a repeating
setInterval on every invocation causing exponential intervals; change the
scheduling call in the loop function to use window.setTimeout(loop, checkPeriod)
(single-shot) so only one delayed callback is queued each iteration, keep the
existing observer.disconnect()/resolve()/reject() logic intact, and ensure the
initial loop() call still starts the cycle; reference the loop function and the
observer variable in tests/browser/tests/utils.ts when making this change.
- Around line 38-41: The timeout branch can call reject() after the promise was
already resolved by the stability check; update the check handling so you exit
immediately after resolving or rejecting: after the stability branch that calls
resolve() when (now - mutated > checkPeriod) and after the timeout branch that
calls reject() when (now - started > timeout), add immediate returns (ensuring
observer.disconnect() is still called before the return) so no further checks
run and the promise cannot be settled twice; look for the uses of resolve(),
reject(), observer.disconnect(), now - mutated > checkPeriod and now - started >
timeout to locate the exact spots to update.

---

Nitpick comments:
In `@jupyter/datascience/ubi9-python-3.12/Dockerfile.cpu`:
- Around line 29-32: The current Dockerfile sets GOCACHE, GOMODCACHE and GOPATH
to overlapping locations which can cause cache pollution; change GOCACHE to a
separate directory (e.g., /cachi2/output/deps/gocache) while leaving GOMODCACHE
as /cachi2/output/deps/gomod/pkg/mod and GOPATH as /cachi2/output/deps/gomod,
and update GOPROXY only if needed; modify the export of GOCACHE in the
Dockerfile.cpu so it points to a distinct path from GOPATH/GOMODCACHE to isolate
build cache from module cache.

In `@jupyter/datascience/ubi9-python-3.12/Dockerfile.konflux.cpu`:
- Around line 52-53: The Dockerfile duplicates GPG key imports with a
silent-failure "|| true" (seen in the RUN lines importing
/cachi2/output/deps/generic/RPM-GPG-KEY-CentOS-Official and
/etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release and again at lines ~95-97); extract
these import commands into a small reusable script (e.g., import-gpg-keys.sh)
and call it from each stage, and remove the blanket "|| true" so the script
performs explicit checks and logs or exits on failure (return non-zero) to
surface errors instead of silencing them. Ensure the script idempotently checks
for an existing key before importing to avoid duplicate failures.
- Around line 1-187: The Dockerfiles are nearly identical except for LABEL
metadata; consolidate into one Dockerfile and drive variant-specific LABEL
values via a build-arg (e.g., BUILD_VARIANT or REGISTRY_TARGET). Edit the
existing Dockerfile.konflux.cpu/jupyter-datascience stage: introduce ARG
BUILD_VARIANT (or REGISTRY_TARGET) near the top, replace the hard-coded LABEL
block in the jupyter-datascience stage with conditional value selection based on
that arg (set descriptive name, component, display-name, summary, description,
license_terms) and default to the current konflux values; ensure Docker build
invocation can pass the alternative variant to produce the other image. Keep all
hermetic LOCAL_BUILD logic, mongocli-builder and stage names (mongocli-builder,
cpu-base, jupyter-minimal, jupyter-datascience) unchanged so only LABELs are
parameterized.

In `@jupyter/minimal/ubi9-python-3.12/prefetch-input/odh/rpms.lock.yaml`:
- Around line 28-41: The rpms.lock.yaml adds build-toolchain packages (autoconf,
automake, cmake, libtool, m4, openblas-devel, pybind11-devel, gcc runtime libs)
which increase the attack surface of the "minimal" Jupyter image; either move
these packages out of the final runtime package list into a separate
build-stage/multi-stage image (so they are installed only during build and not
present in the final image) or, if they are required at runtime for
pip-installing native extensions, explicitly document that requirement in the
repo (e.g., in README or image documentation) and mark these entries as
build-time dependencies—update the entries for autoconf, automake, cmake,
libtool, m4, openblas-devel, pybind11-devel, and gcc-related packages
accordingly across the referenced sections (around lines 2240-2351) to reflect
the chosen approach.

In `@Makefile`:
- Around line 144-145: The Makefile sets GONOSUMDB when invoking go build for
the toolchain (GOTOOLCHAIN=auto) but GONOSUMDB is ignored for
golang.org/toolchain downloads and is misleading; remove the
GONOSUMDB=golang.org/toolchain assignment from the go build invocation (the line
that exports/uses GOTOOLCHAIN=auto and runs go build -C "scripts/buildinputs" -o
"$(ROOT_DIR)/$@" ./...), and if you need to support environments with
GOSUMDB=off, add an explicit guard or documented check that handles GOSUMDB
rather than relying on GONOSUMDB.

In `@runtimes/datascience/ubi9-python-3.12/Dockerfile.cpu`:
- Line 91: The RUN pip install line currently pins "uv==0.10.8" causing version
drift; update that package pin in the RUN command (the pip install statement
that includes "micropipenv[toml]==1.10.0" and "uv==0.10.8") to match the Konflux
Dockerfiles by changing "uv==0.10.8" to "uv==0.11.0" so all builds use the same
uv version.

In `@tests/browser/scripts/start_browser.ts`:
- Around line 62-70: The loop contains redundant null checks for the local
variable page (declared as Page | undefined) and for context?.pages()[0], which
can only be undefined; remove the === null checks and simplify the conditions to
check only undefined (e.g., use page === undefined or page !== undefined) and
likewise rely on optional chaining result being undefined, updating the while
condition and the if that returns page (references: page, started, timeout,
browser.contexts(), context?.pages()[0]).

In `@tests/browser/tests/codeserver.spec.ts`:
- Around line 40-46: Remove the unnecessary optional chaining on
codeServerSource (it is always provided) and replace the verbose IIFE throw with
a simple guard: in the codeServer fixture block, change "if
(codeServerSource?.url)" to "if (codeServerSource.url)" and replace the "const
image = codeServerSource.image ?? (() => { throw new Error('invalid config:
codeserver image not specified') })()" pattern with "const image =
codeServerSource.image; if (!image) throw new Error('invalid config: codeserver
image not specified')", keeping the rest of the logic using new CodeServer(page,
codeServerSource.url) intact.
- Around line 16-22: The MyFixtures type is duplicated; extract it into a single
shared types module named types.ts that exports the MyFixtures type (keeping the
connectCDP and codeServerSource union but removing the per-test-only codeServer
property), then remove the local MyFixtures definitions in both files and import
the shared type (import type { MyFixtures } from './types') in each place where
MyFixtures was previously declared so both tests reference the single canonical
type.

In `@tests/browser/tests/utils.ts`:
- Around line 13-14: Replace the function-scoped declarations using "var" for
the timing variables with block-scoped "let": change "var started =
performance.now();" and "var mutated = started;" to use "let" so that started
and mutated are block-scoped (update both declarations in
tests/browser/tests/utils.ts where these variables are defined).

Verify each finding against the current code and only fix it if needed.

Duplicate comments:
In `@jupyter/rocm/pytorch/ubi9-python-3.12/uv.lock.d/pylock.rocm.toml`:
- Line 2: The command line uses the insecure flag
--index-strategy=unsafe-best-match which can enable dependency-confusion; update
the uv pip compile invocation to use a secure, deterministic index strategy
instead (replace --index-strategy=unsafe-best-match with a safer strategy such
as --index-strategy=prefer-index or another non-unsafe option supported by uv)
and regenerate the lockfile so resolution always favors the intended trusted
index; ensure you update the invocation that includes --index-strategy in the
pylock.rocm.toml comment line.