fix: upgrade to 3.11.11-slim-bookworm to address critical vulnerabilities #32240

gpchandran · 2025-02-13T02:32:54Z

There are few critical vulnerabilities that remain unresolved in the 3.11-slim-bookworm version. To address these , it is good to upgrade to the 3.11.11-slim-bookworm version
Hi @mistercrunch @michael-s-molina - can you please review and approve

#32229
#31503

SUMMARY

BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF

TESTING INSTRUCTIONS

ADDITIONAL INFORMATION

Has associated issue:
Required feature flags:
Changes UI
Includes DB Migration (follow approval process in SIP-59)
- Migration is atomic, supports rollback & is backwards-compatible
- Confirm DB migration upgrade and downgrade tested
- Runtime estimates and downtime expectations provided
Introduces new feature or API
Removes existing feature or API

here are few critical vulnerabilities that remain unresolved in the 3.11-slim-bookworm version. To address these security concerns, it is good to upgrade to the 3.11.11-slim-bookworm version

korbit-ai

I've completed my review and didn't find any issues.

Need a new review? Comment /korbit-review on this PR and I'll review your latest changes.

Korbit Guide: Usage and Customization

Interacting with Korbit

You can manually ask Korbit to review your PR using the /korbit-review command in a comment at the root of your PR.

You can ask Korbit to generate a new PR description using the /korbit-generate-pr-description command in any comment on your PR.

Too many Korbit comments? I can resolve all my comment threads if you use the /korbit-resolve command in any comment on your PR.

Chat with Korbit on issues we post by tagging @korbit-ai in your reply.

Help train Korbit to improve your reviews by giving a 👍 or 👎 on the comments Korbit posts.

Customizing Korbit

Check out our docs on how you can make Korbit work best for you and your team.

Customize Korbit for your organization through the Korbit Console.

Current Korbit Configuration

General Settings

Setting Value

Review Schedule Automatic excluding drafts

Max Issue Count 10

Automatic PR Descriptions ❌

Issue Categories

Category Enabled

Documentation ✅

Logging ✅

Error Handling ✅

Readability ✅

Design ✅

Performance ✅

Security ✅

Functionality ✅

Feedback and Support

Tell us what you think of Korbit

Schedule a call with our team

Email us @ [email protected]

Note

Korbit Pro is free for open source projects 🎉

Looking to add Korbit to your team? Get started with a free 2 week trial here

github-actions

Congrats on making your first PR and thank you for contributing to Superset! 🎉 ❤️

We hope to see you in our Slack community too! Not signed up? Use our Slack App to self-register.

…ties (#32240) (cherry picked from commit ad05732)

Debian 11 bullseye is now the [oldstable release](https://www.debian.org/releases/), and Debian 12 bookworm is the current stable release. The release of node does not have to change at the same time. This is a follow up to apache#32240

gpchandran · 2025-03-17T22:52:49Z

@sadpandajoe - is it possible to cherrypick this PR into 4.1.2rc1? this address lot of debian OS level vulnerabilities

…ties (#32240) (cherry picked from commit ad05732)

gpchandran · 2025-04-16T19:39:51Z

Hi @michael-s-molina, do you have any idea when version 5.0.0 will be released? I checked Apache Superset 5.0.0 and didn't see any blockers, are we waiting on three new issues that need to be resolved.?

Hi @sadpandajoe, could you please assist with creating version 4.1.3 if version 5.0.0 is going to take longer? addressing this critical OS vulnerabilities will help everyone

michael-s-molina · 2025-04-16T20:09:24Z

Hi @michael-s-molina, do you have any idea when version 5.0.0 will be released? I checked Apache Superset 5.0.0 and didn't see any blockers, are we waiting on three new issues that need to be resolved.?

No ETA as we depend on testing and bug fixes from the community. I added one blocker that we're currently working on.

gpchandran · 2025-04-22T16:26:11Z

Hi @michael-s-molina, do you have any idea when version 5.0.0 will be released? I checked Apache Superset 5.0.0 and didn't see any blockers, are we waiting on three new issues that need to be resolved.?

No ETA as we depend on testing and bug fixes from the community. I added one blocker that we're currently working on.

Thanks for your response @michael-s-molina
Hi @sadpandajoe @michael-s-molina - sorry to bother, would you please help create 4.1.3, lot of OS level critical vulnerabilities will be resolved with this base python image upgrade

* chore: bump base image in Dockerfile with `ARG PY_VER=3.11.11-slim-bookworm` (apache#32780) * chore: Revert "chore: bump base image in Dockerfile with `ARG PY_VER=3.11.11-slim-bookworm`" (apache#32782) * fix(chart data): removing query from /chart/data payload when accessing as guest user (apache#30858) (cherry picked from commit dd39138) * fix: upgrade to 3.11.11-slim-bookworm to address critical vulnerabilities (apache#32240) (cherry picked from commit ad05732) * fix(model/helper): represent RLS filter clause in proper textual SQL string (apache#32406) Signed-off-by: hainenber <[email protected]> (cherry picked from commit ff0529c) * fix: Log table retention policy (apache#32572) (cherry picked from commit 89b6d7f) * fix(welcome): perf on distinct recent activities (apache#32608) (cherry picked from commit 832e028) * fix(log): Update recent_activity by event name (apache#32681) (cherry picked from commit 449f51a) * fix: Signature of Celery pruner jobs (apache#32699) (cherry picked from commit df06bdf) * fix(logging): missing path in event data (apache#32708) (cherry picked from commit cd5a943) * fix(fe/dashboard-list): display modifier info for `Last modified` data (apache#32035) Signed-off-by: hainenber <[email protected]> (cherry picked from commit 88cf2d5) * fix: make packages PEP 625 compliant (apache#32866) Co-authored-by: Michael S. Molina <[email protected]> (cherry picked from commit 6e02d19) * all cccs changes * fix: Downgrade to marshmallow<4 (apache#33216) * fix(log): store navigation path to get correct logging path (apache#32795) (cherry picked from commit 4a70065) * fix(pivot-table): Revert "fix(Pivot Table): Fix column width to respect currency config (apache#31414)" (apache#32968) (cherry picked from commit a36e636) * fix: improve error type on parse error (apache#33048) (cherry picked from commit ed0cd5e) * fix(plugin-chart-echarts): remove erroneous upper bound value (apache#32473) (cherry picked from commit 5766c36) * fix(pinot): revert join and subquery flags (apache#32382) (cherry picked from commit 822d72c) * fix: loading examples from raw.githubusercontent.com fails with 429 errors (apache#33354) (cherry picked from commit f045a73) * chore: creating 4.1.3rc1 change log and updating frontend json (cherry picked from commit 72cf9b6) * chore(🦾): bump python sqlglot 26.1.3 -> 26.11.1 (apache#32745) Co-authored-by: GitHub Action <[email protected]> (cherry picked from commit 66c1a6a) * chore(🦾): bump python h11 0.14.0 -> 0.16.0 (apache#33339) Co-authored-by: GitHub Action <[email protected]> (cherry picked from commit 8252686) * docs: CVEs fixed on 4.1.2 (apache#33435) (cherry picked from commit 8a8fb49) * feat(api): Added uuid to list api calls (apache#32414) (cherry picked from commit 8decc9e) * fix(table-chart): time shift is not working (apache#33425) (cherry picked from commit dc44748) * fix(Sqllab): Autocomplete got stuck in UI when open it too fast (apache#33522) (cherry picked from commit b4e2406) * chore: update Dockerfile - Upgrade to 3.11.12 (apache#33612) (cherry picked from commit f0b6e87) * chore: updating 4.1.3rc2 change log * Select all Drag and Drop (#546) * add a select all button for the dnd select * remove cypress * chore(deps): bump cryptography from 43.0.3 to 44.0.1 (apache#32236) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> (cherry picked from commit fa09d81) * fix: Adds missing __init__ file to commands/logs (apache#33059) (cherry picked from commit c1159c5) * fix: Saved queries list break if one query can't be parsed (apache#34289) (cherry picked from commit 1e5a4e9) * chore: Adds 4.1.4RC1 data to CHANGELOG.md and UPDATING.md * tag bump for select all drag and drop * Fix package-lock.json * Add db migration, bump Docker image base * gevent for gunicorn * remove threads and make worker-connections configurable * Fix package-lock.json * tag bump for cccs build * Remove CCCS Dataset Explorer (#550) * tag bump for CCCS build --------- Signed-off-by: hainenber <[email protected]> Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: gpchandran <[email protected]> Co-authored-by: Joe Li <[email protected]> Co-authored-by: Jack <[email protected]> Co-authored-by: Đỗ Trọng Hải <[email protected]> Co-authored-by: Michael S. Molina <[email protected]> Co-authored-by: JUST.in DO IT <[email protected]> Co-authored-by: Michael S. Molina <[email protected]> Co-authored-by: Andreas Motl <[email protected]> Co-authored-by: Ville Brofeldt <[email protected]> Co-authored-by: Yuri <[email protected]> Co-authored-by: Maxime Beauchemin <[email protected]> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: GitHub Action <[email protected]> Co-authored-by: sha174n <[email protected]> Co-authored-by: Paul Rhodes <[email protected]> Co-authored-by: Rafael Benitez <[email protected]> Co-authored-by: cccs-RyanK <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: cyber-jessie <[email protected]>

Update Dockerfile - upgrade to 3.11.11-slim-bookworm

f643d76

here are few critical vulnerabilities that remain unresolved in the 3.11-slim-bookworm version. To address these security concerns, it is good to upgrade to the 3.11.11-slim-bookworm version

pull-request-size bot added the size/XS label Feb 13, 2025

korbit-ai bot reviewed Feb 13, 2025

View reviewed changes

github-actions bot reviewed Feb 13, 2025

View reviewed changes

michael-s-molina approved these changes Feb 13, 2025

View reviewed changes

michael-s-molina changed the title ~~Update Dockerfile - upgrade to 3.11.11-slim-bookworm~~ fix: upgrade to 3.11.11-slim-bookworm to address critical vulnerabilities Feb 13, 2025

michael-s-molina added the v5.0 Label added by the release manager to track PRs to be included in the 5.0 branch label Feb 13, 2025

michael-s-molina merged commit ad05732 into apache:master Feb 13, 2025
51 of 53 checks passed

michael-s-molina pushed a commit that referenced this pull request Feb 14, 2025

fix: upgrade to 3.11.11-slim-bookworm to address critical vulnerabili…

4a298e8

…ties (#32240) (cherry picked from commit ad05732)

dolph mentioned this pull request Mar 13, 2025

fix: Upgrade node base image to Debian 12 bookworm #32652

Merged

9 tasks

gpchandran mentioned this pull request Mar 21, 2025

chore: bump base image in Dockerfile with ARG PY_VER=3.11.11-slim-bookworm #32780

Merged

9 tasks

sadpandajoe pushed a commit that referenced this pull request Mar 24, 2025

fix: upgrade to 3.11.11-slim-bookworm to address critical vulnerabili…

f1e0c9c

…ties (#32240) (cherry picked from commit ad05732)

sadpandajoe added the v4.1 Label added by the release manager to track PRs to be included in the 4.1 branch label Mar 24, 2025

mistercrunch added 🍒 4.1.3 Cherry-picked to 4.1.3 🍒 5.0.0 Cherry-picked to 5.0.0 🏷️ bot A label used by `supersetbot` to keep track of which PR where auto-tagged with release labels labels Jul 29, 2025

github-actions bot added the 🍒 4.1.4 label Aug 28, 2025

silveira-js mentioned this pull request Jan 7, 2026

Add MapLibre support to charts PortalTelemedicina/superset#4

Merged

9 tasks

This was referenced Jan 15, 2026

Point explicit service account to client PortalTelemedicina/superset#9

Merged

Fix margin parameters PortalTelemedicina/superset#10

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix: upgrade to 3.11.11-slim-bookworm to address critical vulnerabilities #32240

fix: upgrade to 3.11.11-slim-bookworm to address critical vulnerabilities #32240

Uh oh!

gpchandran commented Feb 13, 2025 •

edited

Loading

Uh oh!

korbit-ai bot left a comment •

edited

Loading

Uh oh!

github-actions bot left a comment

Uh oh!

Uh oh!

gpchandran commented Mar 17, 2025 •

edited

Loading

Uh oh!

gpchandran commented Apr 16, 2025

Uh oh!

michael-s-molina commented Apr 16, 2025

Uh oh!

gpchandran commented Apr 22, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Setting	Value
Review Schedule	Automatic excluding drafts
Max Issue Count	10
Automatic PR Descriptions	❌

Category	Enabled
Documentation	✅
Logging	✅
Error Handling	✅
Readability	✅
Design	✅
Performance	✅
Security	✅
Functionality	✅

fix: upgrade to 3.11.11-slim-bookworm to address critical vulnerabilities #32240

fix: upgrade to 3.11.11-slim-bookworm to address critical vulnerabilities #32240

Uh oh!

Conversation

gpchandran commented Feb 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

SUMMARY

BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF

TESTING INSTRUCTIONS

ADDITIONAL INFORMATION

Uh oh!

korbit-ai bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Interacting with Korbit

Customizing Korbit

Current Korbit Configuration

Feedback and Support

Looking to add Korbit to your team? Get started with a free 2 week trial here

Uh oh!

github-actions bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

gpchandran commented Mar 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

gpchandran commented Apr 16, 2025

Uh oh!

michael-s-molina commented Apr 16, 2025

Uh oh!

gpchandran commented Apr 22, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

gpchandran commented Feb 13, 2025 •

edited

Loading

korbit-ai bot left a comment •

edited

Loading

gpchandran commented Mar 17, 2025 •

edited

Loading