Upgrade to Python 3.11 and fix most existing vulnerabilities

Dockerfile

@@ -1,4 +1,4 @@
-FROM node:18-bookworm AS frontend-builder
+FROM node:20-bookworm AS frontend-builder
 
 RUN npm install --global --force [email protected]
 
@@ -19,6 +19,7 @@ COPY --chown=redash scripts /frontend/scripts
 # Controls whether to instrument code for coverage information
 ARG code_coverage
 ENV BABEL_ENV=${code_coverage:+test}
+ENV GITHUB_PAT=${GITHUB_PAT}
 
 # Avoid issues caused by lags in disk and network I/O speeds when working on top of QEMU emulation for multi-platform image building.
 RUN yarn config set network-timeout 300000
@@ -37,7 +38,7 @@ RUN <<EOF
   fi
 EOF
 
-FROM python:3.10-slim-bookworm
+FROM python:3.11-slim-bookworm
 
 EXPOSE 5000
 
@@ -98,18 +99,18 @@ WORKDIR /app
 ENV POETRY_VERSION=1.8.3
 ENV POETRY_HOME=/etc/poetry
 ENV POETRY_VIRTUALENVS_CREATE=false
+ENV PIP_PREFER_BINARY=1
 RUN curl -sSL https://install.python-poetry.org | python3 -
 
-# Avoid crashes, including corrupted cache artifacts, when building multi-platform images with GitHub Actions.
-RUN /etc/poetry/bin/poetry cache clear pypi --all
-
+# Use BuildKit cache mount for Poetry cache to speed up builds
 COPY pyproject.toml poetry.lock ./
 
-ARG POETRY_OPTIONS="--no-root --no-interaction --no-ansi"
+ARG POETRY_OPTIONS="--no-root --no-ansi --no-interaction"
 # for LDAP authentication, install with `ldap3` group
 # disabled by default due to GPL license conflict
 ARG install_groups="main,all_ds,dev"
-RUN /etc/poetry/bin/poetry install --only $install_groups $POETRY_OPTIONS
+RUN --mount=type=cache,target=/root/.cache/pypoetry \
+    /etc/poetry/bin/poetry install --only $install_groups $POETRY_OPTIONS
 
 COPY --chown=redash . /app
 COPY --from=frontend-builder --chown=redash /frontend/client/dist /app/client/dist

compose.yaml

@@ -5,12 +5,14 @@ x-redash-service: &redash-service
     context: .
     args:
       skip_frontend_build: "true"  # set to empty string to build
+    # Enable BuildKit for faster builds with cache mounts
+    dockerfile: Dockerfile
   volumes:
     - .:/app
   env_file:
     - .env
 x-redash-environment: &redash-environment
-  REDASH_HOST: http://localhost:5001
+  REDASH_HOST: http://localhost:5000
   REDASH_LOG_LEVEL: "INFO"
   REDASH_REDIS_URL: "redis://redis:6379/0"
   REDASH_DATABASE_URL: "postgresql://postgres@postgres/postgres"
@@ -29,7 +31,7 @@ services:
       - postgres
       - redis
     ports:
-      - "5001:5000"
+      - "5000:5000"
       - "5678:5678"
     environment:
       <<: *redash-environment