Fix vulnerable dependencies and pin versions

Dockerfiles/base/00.python.Dockerfile

@@ -1,9 +1,14 @@
-FROM python:3
+# Pinned to 3.11-slim-bookworm to match CI/CD container and address CVEs in
+# OpenSSL, systemd, Kerberos and other packages present in older base images.
+# Update this tag intentionally — do not use a floating `python:3` tag.
+FROM python:3.11-slim-bookworm
+
 LABEL maintainer="squad:git-defenders" url="https://github.com/IBM/detect-secrets"
 
 RUN \
   apt-get update && \
   apt-get -y remove --purge mysql* && \
   apt-get upgrade -y && \
+  apt-get install -y --no-install-recommends git && \
   rm -rf /var/lib/apt/lists/* && \
   pip install --upgrade pip

Dockerfiles/base/01.cli.Dockerfile

@@ -3,12 +3,16 @@ FROM git-defenders/python
 RUN \
   # Auto adjust line ending. Support running scan on Windows platform
   git config --system core.autocrlf true && \
-  # Improve performace when creating index across Windows and Linux platform
+  # Improve performance when creating index across Windows and Linux platform
   git config --system core.checkStat minimal
 
 COPY setup.py setup.cfg /code/
 COPY detect_secrets /code/detect_secrets
-RUN pip install /code
+
+# Install the package — deps are pinned in setup.py install_requires.
+# pyahocorasick is declared under extras_require['word_list'] so install explicitly.
+RUN pip install /code && \
+    pip install 'pyahocorasick==2.3.1'
 
 # Generate pipenv lock file under /, it will be picked up by trivy
 COPY scripts/gen-pipfile.sh /

detect_secrets/core/secrets_collection.py

@@ -266,7 +266,7 @@ def scan_file(
 
             return True
         except IOError:
-            file_is_binary = is_binary(filename)
+            file_is_binary = os.path.exists(filename) and is_binary(filename)
 
             if not file_is_binary and not suppress_unscannable_file_warnings:
                 log.warning(
@@ -416,7 +416,7 @@ def _extract_secrets_from_file(
                 f.seek(0)
 
         except UnicodeDecodeError:
-            file_is_binary = is_binary(filename)
+            file_is_binary = os.path.exists(filename) and is_binary(filename)
 
             if not file_is_binary and not suppress_unscannable_file_warnings:
                 log.warning(

requirements-dev.txt

@@ -1,20 +1,30 @@
-pip>=21.1
-urllib3>2.4.0
-coverage>=6.0b1
-certifi>=2024.7.4
-flake8
-mock
-monotonic
-pre-commit
-pytest
-pyyaml
-responses
-tox-pip-extensions
-tox>=3.8
-unidiff
-ibm_db
-boxsdk[jwt]<4.0.0
-pyahocorasick
-tabulate
-binaryornot
-chardet>=3.0.2,<7.0.0
+# Development Dependencies - Pinned Versions
+# Updated: 2026-05-28
+# These versions are pinned for reproducible development environments
+
+# Core tools (matching production image)
+pip==26.1.1
+urllib3==2.7.0
+certifi==2026.5.20
+pyyaml==6.0.3
+
+# Production dependencies (matching setup.py)
+boxsdk[jwt]==3.14.0
+pyahocorasick==2.3.1
+tabulate==0.10.0
+binaryornot==0.6.0
+chardet==6.0.0.post1
+
+# Development-only tools (pinned to latest stable)
+coverage==7.6.10
+flake8==7.1.1
+mock==5.1.0
+monotonic==1.6
+pre-commit==4.0.1
+pytest==8.3.4
+responses==0.25.3
+tox>=3.8,<4
+unidiff==0.7.5
+
+# Database driver (for testing)
+ibm-db==3.2.3

setup.py

@@ -22,15 +22,18 @@
     ),
     url='hhttps://github.com/IBM/detect-secrets',
     keywords=['secret-management', 'pre-commit', 'security', 'entropy-checks'],
+    python_requires='>=3.8',
     install_requires=[
-        'pyyaml',
-        'requests',
-        'urllib3>2.4.0',
-        'boxsdk[jwt]<4.0.0',
-        'packaging',
-        'tabulate',
-        'binaryornot',
-        'chardet>=3.0.2,<7.0.0',
+        # Minimum versions set to the secure versions validated during CVE remediation.
+        # Exact pins live in requirements-dev.txt for reproducible dev/CI environments.
+        'pyyaml>=6.0.3',
+        'requests>=2.34.2',
+        'urllib3>=2.7.0',
+        'boxsdk[jwt]>=3.14.0,<4.0.0',
+        'packaging>=20.0',
+        'tabulate>=0.10.0',
+        'binaryornot>=0.6.0',
+        'chardet>=6.0.0,<7.0.0',
     ],
     extras_require={
         'word_list': [