chore(deps): bump python from a7fb1e6 to ce40764 in the docker-base-images group

[dependabot]

Bumps the docker-base-images group with 1 update: python.

Updates python from a7fb1e6 to ce40764

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

---

[seonghobae]

Hourly product loop (12:22 KST): current-head source check backend (Python 3.14) is terminal failure on d5b72dc6 (run 31990608272 / job 95273342523). Dependabot docker-base-images bump; frontend/strix still in progress. Merge is blocked until backend is green on a newer head. Will not re-comment this head.

[github-actions]

PR governance metadata gate is not ready for 13e5bdaafdbf59125292ac34bef685c5bbeaf52b:

• Review decision is CHANGES_REQUESTED; address requested changes before merge.
• Required check strix is FAILURE on the current head.

[opencode-agent]

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

• Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.

• Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.

• Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.

• Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.

• Result: REQUEST_CHANGES

• Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head 2c76e907c130702dbd34978bb8ce118981377d73.

• Head SHA: 2c76e907c130702dbd34978bb8ce118981377d73

• Workflow run: 32128612231

• Workflow attempt: 1

Coverage evidence

Coverage evidence job did not run or did not publish coverage evidence.

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file (3 files)"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file (3 files)"]
  R1 --> V1["required checks"]

Loading

[opencode-agent]

OpenCode Review Overview

• Head SHA: 2c76e907c130702dbd34978bb8ce118981377d73
• Workflow run: 32128612231
• Workflow attempt: 1
• Gate result: REQUEST_CHANGES (approval step)

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

• Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.

• Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.

• Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.

• Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.

• Result: REQUEST_CHANGES

• Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head 2c76e907c130702dbd34978bb8ce118981377d73.

• Head SHA: 2c76e907c130702dbd34978bb8ce118981377d73

• Workflow run: 32128612231

• Workflow attempt: 1

Coverage evidence

Coverage evidence job did not run or did not publish coverage evidence.

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file (3 files)"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file (3 files)"]
  R1 --> V1["required checks"]

Loading

[seonghobae]

@opencode-agent review

Fresh same-head review request for 2c76e907c130702dbd34978bb8ce118981377d73. Repository-owned Application CI, Security Scan, Bandit, Dependency Review, Semgrep and Docker build are all terminal-success on this exact head. The active OpenCode REQUEST_CHANGES is a coverage-evidence failure from the pre-repair central materializer path; re-evaluate this unchanged current head using the repaired central coverage/test/docstring evidence and return a new formal verdict. Do not transfer predecessor or infrastructure-only verdicts.

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[seonghobae]

Exact-head Strix failure disposition

• Exact head SHA: 13e5bdaafdbf59125292ac34bef685c5bbeaf52b
• Strix run: 32443637569 (strix job 96659068439)
• Root cause from the failed job: NVIDIA NIM returned rate-limit/404 provider errors; the configured GitHub Models fallbacks also returned provider 410 responses. The gate correctly failed closed because no complete structured report was produced.
• Repository Security Scan, Bandit, dependency-review, and OSV evidence are successful for this head. The Strix log contains no current-head source location establishing a vulnerability; the reported model output was limited to unchanged files and the run remained incomplete.
• Decision: treat this as provider infrastructure failure, not a source finding and not a force-merge/deadlock candidate. Re-run fresh exact-head Strix/provider evidence after capacity or fallback availability recovers; do not reuse this failed run as success.

[seonghobae]

The failing strix check (job 96659068439) is a false positive unrelated to this PR's diff. This PR only touches CHANGELOG.md, Dockerfile, and connector/Dockerfile (a python base-image bump). The single HIGH finding — Untrusted Container Registry Usage (KSV-0125) — flags pre-existing k8s/backend-deployment.yaml, k8s/db-statefulset.yaml, and k8s/frontend-deployment.yaml for referencing ghcr.io/docker.io, against a generic policy that only allowlists gcr.io/ECR.

ghcr.io is this repo's documented, intended registry (see AGENTS.md 'GHCR publishing evidence for the combined naruon image...' and the release-governance docs); it is not an untrusted source here. This looks like a generic KSV-0125 ruleset mismatch against this org's actual registry policy, not a real vulnerability, and it isn't introduced or touched by this dependency bump.

Not fixing k8s registry config in this PR since that would be unrelated scope creep on a routine dependabot bump. Flagging for whoever re-triggers/reviews this: either the strix gate needs a documented narrow exception for the org's own GHCR images, or a fresh scan run may simply not reproduce this again.

[dependabot]

Looks like python is updatable in another way, so this is no longer needed.