benispeti opened a new issue, #45063: URL: https://github.com/apache/superset/issues/45063
### Bug description **Description** A Syft SBOM scan of dhi.io/superset:6.1.0-debian13 identified Python packaging tools and potential development utilities in the runtime image. This report concerns a Docker Hardened Image distribution. Please clarify whether these dependencies originate from Superset’s dependency configuration or image packaging, and whether this issue should be directed to the image maintainer. **Packages Identified** Package Version(s) Reason for review pip 26.2.1 Package installation tool; potentially unnecessary after image build python3-pip-whl 26.2.1-0 Bundled pip wheel, typically used for environment bootstrapping setuptools 84.0.0 Build/packaging tooling; check for runtime dependencies before removal python3-setuptools-whl 84.0.0-0 Bundled setuptools wheel wheel 0.46.3, 0.48.0 Wheel packaging tooling; two versions reported invoke 3.0.3 Task-execution tooling; verify whether needed outside development/build workflows watchdog 6.0.0 Filesystem monitoring; verify whether required by production features or only development reload workflows **Concern** Where these packages are not required at runtime, retaining them increases image size, attack surface, and vulnerability-monitoring and remediation effort. Removing unnecessary packages would eliminate vulnerabilities attributable to those removed components and reduce future exposure. This report does not establish any specific CVE or exploitable vulnerability. **Requested Investigation** * Confirm which listed packages are required by supported production workflows. * Keep build-only and development-only dependencies outside the final runtime image where practical. * Investigate whether the two reported wheel versions represent separate installations, bundled copies, or scanner metadata. * Remove unnecessary packages and bundled installation artifacts, or document why they must remain. * Validate startup, migrations, workers, reporting, and other affected workflows after removal. * Clarify whether remediation belongs in Superset or the Docker Hardened Image packaging. **Scope and Evidence** The Syft report is attached. Its table output does not provide dependency relationships or package locations, so these are investigation candidates rather than confirmed unused dependencies. selenium and pgsanity are also present but are not proposed for unconditional removal: they can support Superset screenshot/report generation and SQL validation, respectively. No my-test-package entry appears in this report. ### Screenshots/recordings _No response_ ### Superset version master / latest-dev ### Python version 3.11 ### Node version 16 ### Browser Chrome ### Additional context _No response_ ### Checklist - [ ] I have searched Superset docs and Slack and didn't find a solution to my problem. - [ ] I have searched the GitHub issue tracker and didn't find a similar bug report. - [ ] I have checked Superset's logs for errors and if I found a relevant Python stacktrace, I included it here as text in the "additional context" section. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
