chore(cyclonedx-bom): Bump to 6.0.0

Author: NickLarsenNZ

CHANGELOG.md

@@ -39,6 +39,7 @@ All notable changes to this project will be documented in this file.
 - jmx_exporter: Bump products to use `1.2.0` ([#xxx]).
 - kubectl: Bump products to use `1.33.0` ([#xxx]).
 - yq: Bump products to use `4.45.2` ([#xxx]).
+- cyclonedx-bom: Bump airflow and superset to use `6.0.0` ([#xxx]).
 
 ### Fixed
 

airflow/Dockerfile

@@ -29,6 +29,8 @@ ARG STATSD_EXPORTER
 ARG PYTHON
 ARG TARGETARCH
 ARG STACKABLE_USER_UID
+ARG S3FS
+ARG CYCLONEDX_BOM
 
 COPY airflow/constraints-${PRODUCT}-python${PYTHON}.txt /tmp/constraints.txt
 COPY --from=opa-auth-manager-builder /tmp/opa-auth-manager/dist/opa_auth_manager-0.1.0-py3-none-any.whl /tmp/
@@ -68,7 +70,7 @@ source /stackable/app/bin/activate
 pip install --no-cache-dir --upgrade pip
 pip install --no-cache-dir apache-airflow[${AIRFLOW_EXTRAS}]==${PRODUCT} --constraint /tmp/constraints.txt
 # Needed for pandas S3 integration to e.g. write and read csv and parquet files to/from S3
-pip install --no-cache-dir s3fs==2024.9.0 cyclonedx-bom==5.0.0
+pip install --no-cache-dir s3fs==${S3FS} cyclonedx-bom==${CYCLONEDX_BOM}
 # Needed for OIDC
 pip install --no-cache-dir Flask_OIDC==2.2.0 Flask-OpenID==1.3.1
 

airflow/versions.py

@@ -3,6 +3,8 @@
         "product": "2.9.3",
         "python": "3.9",
         "git_sync": "v4.4.0",
+        "s3fs": "2024.9.0",
+        "cyclonedx_bom": "6.0.0",
         "statsd_exporter": "0.28.0",
         "tini": "0.19.0",
         "vector": "0.43.1",
@@ -11,6 +13,8 @@
         "product": "2.10.4",
         "python": "3.12",
         "git_sync": "v4.4.0",
+        "s3fs": "2024.9.0",
+        "cyclonedx_bom": "6.0.0",
         "statsd_exporter": "0.28.0",
         "tini": "0.19.0",
         "vector": "0.43.1",

superset/Dockerfile

@@ -40,6 +40,7 @@ ARG PYTHON
 ARG AUTHLIB
 ARG TARGETARCH
 ARG TARGETOS
+ARG CYCLONEDX_BOM
 
 COPY superset/constraints-${PRODUCT}.txt /tmp/constraints.txt
 COPY --from=opa-authorizer-builder /tmp/opa-authorizer/dist/opa_authorizer-0.1.0-py3-none-any.whl /tmp/
@@ -109,7 +110,7 @@ RUN python3 -m venv /stackable/app \
         --no-cache-dir \
         --upgrade \
         python-json-logger \
-        cyclonedx-bom \
+        cyclonedx-bom==${CYCLONEDX_BOM} \
     && if [ -n "$AUTHLIB" ]; then pip install Authlib==${AUTHLIB}; fi && \
     pip install --no-cache-dir /tmp/opa_authorizer-0.1.0-py3-none-any.whl
 

superset/versions.py

@@ -2,6 +2,7 @@
     {
         "product": "4.0.2",
         "python": "3.9",
+        "cyclonedx_bom": "6.0.0",
         "vector": "0.43.1",
         "statsd_exporter": "0.28.0",
         "authlib": "1.2.1",  # https://github.com/dpgaspar/Flask-AppBuilder/blob/release/4.4.1/requirements/extra.txt#L7
@@ -10,6 +11,7 @@
     {
         "product": "4.1.1",
         "python": "3.9",  # 3.11 support was merged in January 2025 (two months after 4.1.1 release), 3.10 is not available in our UBI image, so we need to stay on 3.9 for now
+        "cyclonedx_bom": "6.0.0",
         "vector": "0.43.1",
         "statsd_exporter": "0.28.0",
         "authlib": "1.2.1",  # https://github.com/dpgaspar/Flask-AppBuilder/blob/release/4.5.0/requirements/extra.txt#L7