chore: bump base image in Dockerfile with `ARG PY_VER=3.11.11-slim-bookworm` #32780

gpchandran · 2025-03-20T21:08:50Z

Debian OS upgrade fix some critical OS vulnerabilities

SUMMARY

BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF

TESTING INSTRUCTIONS

ADDITIONAL INFORMATION

Has associated issue:
Required feature flags:
Changes UI
Includes DB Migration (follow approval process in SIP-59)
- Migration is atomic, supports rollback & is backwards-compatible
- Confirm DB migration upgrade and downgrade tested
- Runtime estimates and downtime expectations provided
Introduces new feature or API
Removes existing feature or API

Debian OS upgrade fix some critical OS vulnerabilities

korbit-ai

I've completed my review and didn't find any issues.

Need a new review? Comment /korbit-review on this PR and I'll review your latest changes.

Korbit Guide: Usage and Customization

Interacting with Korbit

You can manually ask Korbit to review your PR using the /korbit-review command in a comment at the root of your PR.

You can ask Korbit to generate a new PR description using the /korbit-generate-pr-description command in any comment on your PR.

Too many Korbit comments? I can resolve all my comment threads if you use the /korbit-resolve command in any comment on your PR.

On any given comment that Korbit raises on your pull request, you can have a discussion with Korbit by replying to the comment.

Help train Korbit to improve your reviews by giving a 👍 or 👎 on the comments Korbit posts.

Customizing Korbit

Check out our docs on how you can make Korbit work best for you and your team.

Customize Korbit for your organization through the Korbit Console.

Current Korbit Configuration

General Settings

Setting Value

Review Schedule Automatic excluding drafts

Max Issue Count 10

Automatic PR Descriptions ❌

Issue Categories

Category Enabled

Documentation ✅

Logging ✅

Error Handling ✅

Readability ✅

Design ✅

Performance ✅

Security ✅

Functionality ✅

Feedback and Support

Tell us what you think of Korbit

Schedule a call with our team

Email us @ support@korbit.ai

Note

Korbit Pro is free for open source projects 🎉

Looking to add Korbit to your team? Get started with a free 2 week trial here

gpchandran · 2025-03-20T21:10:13Z

@sadpandajoe - can you please review and consider this PR for 4.1.2, This will address Debian OS level Critical and High Vulnerabilities

mistercrunch · 2025-03-21T01:30:29Z

LGTM + added the flag v4.1 that tells the release manager to consider for LTS

One side thought is that it'd be great to align our CI with exact python version with the docker image, but can decouple that from this PR. Here's where it lives in CI -> https://github.com/apache/superset/blob/master/.github/actions/setup-backend/action.yml#L29

sadpandajoe · 2025-03-21T01:30:37Z

@sadpandajoe - can you please review and consider this PR for 4.1.2, This will address Debian OS level Critical and High Vulnerabilities

Probably not for 4.1.2 but for the next one

sadpandajoe · 2025-03-21T01:32:05Z

@mistercrunch wait, this wasn't pointed to master and instead was merged directly into the 4.1 branch. It means if this wasn't done, it won't be picked up in future releases.

mistercrunch · 2025-03-21T01:32:20Z

Oh ooops.

mistercrunch · 2025-03-21T01:33:10Z

Man they need to make make it flashing-bright-red when the PR isn't targeting the main branch. What should we do here? Revert?

mistercrunch · 2025-03-21T01:34:11Z

Could use a new PR against master for sure though.

sadpandajoe · 2025-03-21T01:34:17Z

I just created a new pr to revert this in the 4.1 branch and then will merge that in. But if this isn't already opened in master, we should open it again against master.

gpchandran · 2025-03-21T15:41:39Z

Sorry @sadpandajoe @mistercrunch - I did create PR to master - #32240 - pinged here for cherrypick into 4.1.2

Is it possible to consider for 4.1.2 as 5.0.0 release taking time @michael-s-molina

sadpandajoe · 2025-03-21T15:52:47Z

Sorry @sadpandajoe @mistercrunch - I did create PR to master - #32240 - pinged here for cherrypick into 4.1.2

Is it possible to consider for 4.1.2 as 5.0.0 release taking time @michael-s-molina

Not for 4.1.2 as I think we'll have the votes for that official release. We may cut a 4.1.3 with some other fixes in so it can make it into that one.

* chore: bump base image in Dockerfile with `ARG PY_VER=3.11.11-slim-bookworm` (apache#32780) * chore: Revert "chore: bump base image in Dockerfile with `ARG PY_VER=3.11.11-slim-bookworm`" (apache#32782) * fix(chart data): removing query from /chart/data payload when accessing as guest user (apache#30858) (cherry picked from commit dd39138) * fix: upgrade to 3.11.11-slim-bookworm to address critical vulnerabilities (apache#32240) (cherry picked from commit ad05732) * fix(model/helper): represent RLS filter clause in proper textual SQL string (apache#32406) Signed-off-by: hainenber <dotronghai96@gmail.com> (cherry picked from commit ff0529c) * fix: Log table retention policy (apache#32572) (cherry picked from commit 89b6d7f) * fix(welcome): perf on distinct recent activities (apache#32608) (cherry picked from commit 832e028) * fix(log): Update recent_activity by event name (apache#32681) (cherry picked from commit 449f51a) * fix: Signature of Celery pruner jobs (apache#32699) (cherry picked from commit df06bdf) * fix(logging): missing path in event data (apache#32708) (cherry picked from commit cd5a943) * fix(fe/dashboard-list): display modifier info for `Last modified` data (apache#32035) Signed-off-by: hainenber <dotronghai96@gmail.com> (cherry picked from commit 88cf2d5) * fix: make packages PEP 625 compliant (apache#32866) Co-authored-by: Michael S. Molina <michael.s.molina@gmail.com> (cherry picked from commit 6e02d19) * all cccs changes * fix: Downgrade to marshmallow<4 (apache#33216) * fix(log): store navigation path to get correct logging path (apache#32795) (cherry picked from commit 4a70065) * fix(pivot-table): Revert "fix(Pivot Table): Fix column width to respect currency config (apache#31414)" (apache#32968) (cherry picked from commit a36e636) * fix: improve error type on parse error (apache#33048) (cherry picked from commit ed0cd5e) * fix(plugin-chart-echarts): remove erroneous upper bound value (apache#32473) (cherry picked from commit 5766c36) * fix(pinot): revert join and subquery flags (apache#32382) (cherry picked from commit 822d72c) * fix: loading examples from raw.githubusercontent.com fails with 429 errors (apache#33354) (cherry picked from commit f045a73) * chore: creating 4.1.3rc1 change log and updating frontend json (cherry picked from commit 72cf9b6) * chore(🦾): bump python sqlglot 26.1.3 -> 26.11.1 (apache#32745) Co-authored-by: GitHub Action <action@github.com> (cherry picked from commit 66c1a6a) * chore(🦾): bump python h11 0.14.0 -> 0.16.0 (apache#33339) Co-authored-by: GitHub Action <action@github.com> (cherry picked from commit 8252686) * docs: CVEs fixed on 4.1.2 (apache#33435) (cherry picked from commit 8a8fb49) * feat(api): Added uuid to list api calls (apache#32414) (cherry picked from commit 8decc9e) * fix(table-chart): time shift is not working (apache#33425) (cherry picked from commit dc44748) * fix(Sqllab): Autocomplete got stuck in UI when open it too fast (apache#33522) (cherry picked from commit b4e2406) * chore: update Dockerfile - Upgrade to 3.11.12 (apache#33612) (cherry picked from commit f0b6e87) * chore: updating 4.1.3rc2 change log * Select all Drag and Drop (#546) * add a select all button for the dnd select * remove cypress * chore(deps): bump cryptography from 43.0.3 to 44.0.1 (apache#32236) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> (cherry picked from commit fa09d81) * fix: Adds missing __init__ file to commands/logs (apache#33059) (cherry picked from commit c1159c5) * fix: Saved queries list break if one query can't be parsed (apache#34289) (cherry picked from commit 1e5a4e9) * chore: Adds 4.1.4RC1 data to CHANGELOG.md and UPDATING.md * tag bump for select all drag and drop * Fix package-lock.json * Add db migration, bump Docker image base * gevent for gunicorn * remove threads and make worker-connections configurable * Fix package-lock.json * tag bump for cccs build * Remove CCCS Dataset Explorer (#550) * tag bump for CCCS build --------- Signed-off-by: hainenber <dotronghai96@gmail.com> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: gpchandran <poorana@gmail.com> Co-authored-by: Joe Li <joe@preset.io> Co-authored-by: Jack <41238731+fisjac@users.noreply.github.com> Co-authored-by: Đỗ Trọng Hải <41283691+hainenber@users.noreply.github.com> Co-authored-by: Michael S. Molina <70410625+michael-s-molina@users.noreply.github.com> Co-authored-by: JUST.in DO IT <justin.park@airbnb.com> Co-authored-by: Michael S. Molina <michael.s.molina@gmail.com> Co-authored-by: Andreas Motl <andreas.motl@crate.io> Co-authored-by: Ville Brofeldt <33317356+villebro@users.noreply.github.com> Co-authored-by: Yuri <yuri.bogomolov@robinhood.com> Co-authored-by: Maxime Beauchemin <maximebeauchemin@gmail.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: GitHub Action <action@github.com> Co-authored-by: sha174n <105581038+sha174n@users.noreply.github.com> Co-authored-by: Paul Rhodes <withnale@users.noreply.github.com> Co-authored-by: Rafael Benitez <rebenitez1802@gmail.com> Co-authored-by: cccs-RyanK <102618419+cccs-RyanK@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: cyber-jessie <jessica.morris@cyber.gc.ca>

Update Dockerfile

7431aad

Debian OS upgrade fix some critical OS vulnerabilities

pull-request-size bot added the size/XS label Mar 20, 2025

korbit-ai bot reviewed Mar 20, 2025

View reviewed changes

rusackas requested a review from mistercrunch March 20, 2025 22:53

mistercrunch approved these changes Mar 21, 2025

View reviewed changes

mistercrunch changed the title ~~Update Dockerfile~~ chore: bump base image in Dockerfile with ARG PY_VER=3.11.11-slim-bookworm Mar 21, 2025

mistercrunch added the v4.1 Label added by the release manager to track PRs to be included in the 4.1 branch label Mar 21, 2025

mistercrunch merged commit 7c8dc95 into apache:4.1 Mar 21, 2025
33 of 34 checks passed

sadpandajoe mentioned this pull request Mar 21, 2025

chore: Revert "chore: bump base image in Dockerfile with ARG PY_VER=3.11.11-slim-bookworm" #32782

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore: bump base image in Dockerfile with `ARG PY_VER=3.11.11-slim-bookworm` #32780

chore: bump base image in Dockerfile with `ARG PY_VER=3.11.11-slim-bookworm` #32780

Uh oh!

gpchandran commented Mar 20, 2025

Uh oh!

korbit-ai bot left a comment •

edited

Loading

Uh oh!

gpchandran commented Mar 20, 2025 •

edited

Loading

Uh oh!

mistercrunch commented Mar 21, 2025

Uh oh!

sadpandajoe commented Mar 21, 2025

Uh oh!

Uh oh!

sadpandajoe commented Mar 21, 2025

Uh oh!

mistercrunch commented Mar 21, 2025

Uh oh!

mistercrunch commented Mar 21, 2025 •

edited

Loading

Uh oh!

mistercrunch commented Mar 21, 2025

Uh oh!

sadpandajoe commented Mar 21, 2025

Uh oh!

gpchandran commented Mar 21, 2025

Uh oh!

sadpandajoe commented Mar 21, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Setting	Value
Review Schedule	Automatic excluding drafts
Max Issue Count	10
Automatic PR Descriptions	❌

Category	Enabled
Documentation	✅
Logging	✅
Error Handling	✅
Readability	✅
Design	✅
Performance	✅
Security	✅
Functionality	✅

chore: bump base image in Dockerfile with ARG PY_VER=3.11.11-slim-bookworm #32780

chore: bump base image in Dockerfile with ARG PY_VER=3.11.11-slim-bookworm #32780

Uh oh!

Conversation

gpchandran commented Mar 20, 2025

SUMMARY

BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF

TESTING INSTRUCTIONS

ADDITIONAL INFORMATION

Uh oh!

korbit-ai bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Interacting with Korbit

Customizing Korbit

Current Korbit Configuration

Feedback and Support

Looking to add Korbit to your team? Get started with a free 2 week trial here

Uh oh!

gpchandran commented Mar 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mistercrunch commented Mar 21, 2025

Uh oh!

sadpandajoe commented Mar 21, 2025

Uh oh!

Uh oh!

sadpandajoe commented Mar 21, 2025

Uh oh!

mistercrunch commented Mar 21, 2025

Uh oh!

mistercrunch commented Mar 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mistercrunch commented Mar 21, 2025

Uh oh!

sadpandajoe commented Mar 21, 2025

Uh oh!

gpchandran commented Mar 21, 2025

Uh oh!

sadpandajoe commented Mar 21, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

chore: bump base image in Dockerfile with `ARG PY_VER=3.11.11-slim-bookworm` #32780

chore: bump base image in Dockerfile with `ARG PY_VER=3.11.11-slim-bookworm` #32780

korbit-ai bot left a comment •

edited

Loading

gpchandran commented Mar 20, 2025 •

edited

Loading

mistercrunch commented Mar 21, 2025 •

edited

Loading