From c3fc3b5085130dff969417baa670e6b6789d845c Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 5 Oct 2026 22:15:43 +0000 Subject: [PATCH 1/3] chore(deps): Bump python Bumps python from 3.11.16-slim-bookworm to 3.11.17-slim-bookworm. --- updated-dependencies: - dependency-name: python dependency-version: 3.11.17-slim-bookworm dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] --- Dockerfile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Dockerfile b/Dockerfile index 822c1ce..f16ed40 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,6 +1,6 @@ # Base image pinned by its multi-arch index digest, so a re-pushed tag cannot # change what is built. Refresh the digest and the tag together. -FROM python:3.11.16-slim-bookworm@sha256:a36c24f9cbdf4fd0f52d67f0823eeac19c2028c637cecc392d97f980d4fec56b AS builder +FROM python:3.11.17-slim-bookworm@sha256:2333bd330d12de02514770b3585cad313644316047cdee24a7acfdece6de6efb AS builder ENV PIP_DISABLE_PIP_VERSION_CHECK=1 \ PIP_NO_CACHE_DIR=1 @@ -14,7 +14,7 @@ COPY pyproject.toml README.md LICENSE NOTICE ./ COPY src ./src RUN python -m pip wheel --no-deps --no-build-isolation --wheel-dir /wheels . -FROM python:3.11.16-slim-bookworm@sha256:a36c24f9cbdf4fd0f52d67f0823eeac19c2028c637cecc392d97f980d4fec56b AS runtime +FROM python:3.11.17-slim-bookworm@sha256:2333bd330d12de02514770b3585cad313644316047cdee24a7acfdece6de6efb AS runtime ENV PIP_DISABLE_PIP_VERSION_CHECK=1 \ PIP_NO_CACHE_DIR=1 \ From c5f6372411592136908c4f113312ceb9a0cfe76b Mon Sep 17 00:00:00 2001 From: Imran Siddique <45405841+imran-siddique@users.noreply.github.com> Date: Mon, 5 Oct 2026 15:31:13 -0700 Subject: [PATCH 2/3] test: accept any pinned 3.11 patch for the base image The container test hardcoded 3.11.16, so every Python patch bump from Dependabot failed it. It still requires a patch release and a sha256 digest on both stages. Signed-off-by: Imran Siddique <45405841+imran-siddique@users.noreply.github.com> Co-Authored-By: Claude Opus 5.5 --- tests/unit/test_container_release.py | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/tests/unit/test_container_release.py b/tests/unit/test_container_release.py index 257fac8..2d018eb 100644 --- a/tests/unit/test_container_release.py +++ b/tests/unit/test_container_release.py @@ -11,8 +11,10 @@ def test_runtime_image_is_multistage_non_root_and_offline_installed() -> None: dockerfile = Path("Dockerfile").read_text(encoding="utf-8") - # Both stages pin the base image by digest, not by tag alone. - assert dockerfile.count("FROM python:3.11.16-slim-bookworm@sha256:") == 2 + # Both stages pin the base image by patch release and digest, not by tag alone. + assert len(re.findall( + r"^FROM python:3\.11\.\d+-slim-bookworm@sha256:[0-9a-f]{64} AS ", dockerfile, re.M + )) == 2 assert "AS builder" in dockerfile assert "pip install --require-hashes -r requirements/build.txt" in dockerfile assert "pip wheel --no-deps --no-build-isolation --wheel-dir /wheels ." in dockerfile From a29e3e514c875d69f95d6e86f8a666cf0792f271 Mon Sep 17 00:00:00 2001 From: Imran Siddique <45405841+imran-siddique@users.noreply.github.com> Date: Mon, 5 Oct 2026 16:33:11 -0700 Subject: [PATCH 3/3] style: format the base-image assertion Signed-off-by: Imran Siddique <45405841+imran-siddique@users.noreply.github.com> Co-Authored-By: Claude Opus 5.5 --- tests/unit/test_container_release.py | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/tests/unit/test_container_release.py b/tests/unit/test_container_release.py index 2d018eb..728ffb7 100644 --- a/tests/unit/test_container_release.py +++ b/tests/unit/test_container_release.py @@ -12,9 +12,10 @@ def test_runtime_image_is_multistage_non_root_and_offline_installed() -> None: dockerfile = Path("Dockerfile").read_text(encoding="utf-8") # Both stages pin the base image by patch release and digest, not by tag alone. - assert len(re.findall( + base_stages = re.findall( r"^FROM python:3\.11\.\d+-slim-bookworm@sha256:[0-9a-f]{64} AS ", dockerfile, re.M - )) == 2 + ) + assert len(base_stages) == 2 assert "AS builder" in dockerfile assert "pip install --require-hashes -r requirements/build.txt" in dockerfile assert "pip wheel --no-deps --no-build-isolation --wheel-dir /wheels ." in dockerfile