Skip to content

[Snyk] Security upgrade python from 3.13.7-slim to 3.14.1-slim #12

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
doublegate wants to merge 1 commit into
base: main
Choose a base branch
from
+2 −2
Open

[Snyk] Security upgrade python from 3.13.7-slim to 3.14.1-slim #12

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions services/arms/retriever/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
# syntax=docker/dockerfile:1
# Retriever Arm Dockerfile - Multi-stage build for Python service
FROM python:3.13.7-slim as builder
FROM python:3.14.1-slim as builder
Copy link

@gemini-code-assist gemini-code-assist bot Dec 9, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

critical

This base image upgrade introduces a build failure. The COPY instruction on line 41 has a hardcoded path for Python 3.13: COPY --from=builder /usr/local/lib/python3.13/site-packages ....

Since the builder stage now uses Python 3.14, this path no longer exists, and the build will fail. The destination path is also incorrect.

To fix this, you need to update the path on line 41 to use python3.14.

A more robust solution for the future would be to use an ARG to define the Python version and use it in both the FROM and COPY instructions. For example:

ARG PYTHON_VERSION=3.14
ARG PYTHON_FULL_VERSION=3.14.1
FROM python:${PYTHON_FULL_VERSION}-slim as builder
...
COPY --from=builder /usr/local/lib/python${PYTHON_VERSION}/site-packages /usr/local/lib/python${PYTHON_VERSION}/site-packages

Copy link

Copilot AI Dec 9, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The Python version upgrade is incomplete. While the FROM statements have been updated to 3.14.1, line 41 still references the old Python 3.13 directory path:

COPY --from=builder /usr/local/lib/python3.13/site-packages /usr/local/lib/python3.13/site-packages

This line must also be updated to use python3.14 instead of python3.13, otherwise the Docker build will fail when trying to copy from a non-existent directory:

COPY --from=builder /usr/local/lib/python3.14/site-packages /usr/local/lib/python3.14/site-packages

Copilot uses AI. Check for mistakes.

Comment on lines +3 to 4
Copy link

@chatgpt-codex-connector chatgpt-codex-connector bot Dec 9, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Copy site-packages from non-existent Python 3.13 path

After bumping the builder base to python:3.14.1-slim, the later COPY still targets /usr/local/lib/python3.13/site-packages (line 41). In Python 3.14 images that path is absent, so the copy step will fail or leave the runtime image without installed dependencies, blocking image builds. Update the source/destination to the 3.14 site-packages path to match the new base image.

Useful? React with 👍 / 👎.

# Install system dependencies
RUN apt-get update && apt-get install -y \
Expand All @@ -23,7 +23,7 @@ RUN poetry config virtualenvs.create false && \
poetry install --only main --no-interaction --no-ansi

# Runtime stage
FROM python:3.13.7-slim
FROM python:3.14.1-slim

# Install runtime dependencies
RUN apt-get update && apt-get install -y \
Expand Down
Loading