Hi, I’m currently using the OPAL Alpine-based image and noticed that Trivy reported a vulnerability related to Starlette: CVE-2025-62727 Ref: https://avd.aquasec.com/nvd/2025/cve-2025-62727/ Since the OPAL image bundles Starlette, may I ask if there is a plan to update the Starlette version to address this CVE? Thanks~

Thanks for the feedback, glad I was helpful.

Hey @Tony Ou, We’ve opened a ticket for this. We don’t have an estimated timeline yet, but in the meantime, if you’re interested in contributing, we’d be very happy to review a PR from you!

Hi @Alon Boshi, maybe I can help! According to a trivy scan, the starlette version in the Docker Hub image opal-client-standalone:0.9.2-rc.1-alpine is currently 0.49.0 (while the security fix is in 0.49.1). I checked opal\packages\requires.txt, and the version constraint for starlette should allow installing the latest 0.50.0. I also cloned the project, switched to the 0.9.2-rc.1 tag, and built the opal-client-standalone image myself—the installed starlette version was 0.50.0. This leads me to suspect that perhaps package cache or something in the build process is preventing your environment from picking up the latest version. Is there anything I can help check, or do you have any recommended debug steps? Thank you!

Hey, thanks for reaching out ! It seems our team is a little busy right now, a human will be with you within the next hour or so. In the meantime, can I help you ?

Hi @Alon Boshi, @Eli Moshkovich, just following up on my earlier message regarding the Starlette version and the CVE. Let me know if there’s any update or anything I can help with. Thanks!

Hey, thanks for reaching out ! It seems our team is a little busy right now, a human will be with you within the next hour or so. In the meantime, can I help you ?

Hi @Tony Ou - thanks for following up. Let me check with the team and one of us will get back to you.

Hey @Tony Ou, You can pull the latest release - 0.9.2 Thanks for flagging this. Let me know if anything else comes up!

HI @Alon Boshi , thanks for the quick response! I’ve tested the latest release (0.9.2), and the issue still seems to persist. Using Trivy to scan the image:

trivy image permitio/opal-client-standalone:0.9.2-alpine

It reports the vulnerability under the following path:

usr/local/lib/python3.10/site-packages/starlette-0.49.0.dist-info/METADATA

(see attached screenshot) I also entered the container to double-check manually:

docker run -it --rm permitio/opal-client-standalone:0.9.2-alpine sh

find usr/local/lib/python3.10/site-packages/ -iname "*starlette*"

It shows that Starlette is still at version 0.49.0. (see attached screenshot) Let me know if you need any additional details — happy to help test further!

Hey @Tony Ou! Thanks for double-checking this and for the screenshots — super helpful 🙏 Looks like the updated Starlette version didn’t make it into the

0.9.2-alpine

image after all. A few options you can take from here: 1. Contribute a fix — you’re welcome to open a PR with the version bump, and we’ll review it quickly. 2. Build the OPAL images yourself — since everything’s open-source, you can rebuild the client image with the updated Starlette to unblock yourself. 3. Wait for the next OPAL release — we’ll include the fix, but don’t have an exact date yet. Happy to help with any of these paths! Let me know what works for you.

Hi @Alon Boshi, If possible, I’d like to understand a bit more about what’s causing this issue — I might be able to take a look and see if I can help. From what I understand, Starlette’s version is controlled by

opal/packages/requires.txt

, and the current constraint

starlette>=0.40.0,<1

should allow installing version 0.50.0 (the vulnerability was fixed after 0.49.1). I also cloned the project, switched to the corresponding tag, and built the

opal-client-standalone

(alpine version) locally, and in that environment Starlette does upgrade to 0.50.0. However, the official

0.9.2-alpine

image on Docker Hub still ships with Starlette 0.49.0, so it seems like there may be other factors involved. If you could share some pointers or background on the build process, that would be really helpful — I’d like to start from there and try to understand what’s happening.

Hey, thanks for reaching out ! It seems our team is a little busy right now, a human will be with you within the next hour or so. In the meantime, can I help you ?

@Tony Ou - thanks for reaching out. I’m checking with the team and will get back to you tomorrow.

@Tony Ou Thanks for digging into this — your analysis is spot-on, and we really appreciate the effort you’ve already put in. We made another attempt at addressing the Starlette version issue, and you’re welcome to try the updated build here: https://github.com/permitio/opal/releases/tag/v0.9.3-rc.1