This repository was archived by the owner on Aug 6, 2026. It is now read-only.
fix(docker): bump base image to python:3.13-slim to clear base-image CVEs - #5
Open
cdcore09 wants to merge 1 commit into
Open
fix(docker): bump base image to python:3.13-slim to clear base-image CVEs#5cdcore09 wants to merge 1 commit into
cdcore09 wants to merge 1 commit into
Conversation
…CVEs Snyk flagged 4 vulnerabilities in the python:3.12-slim base image (#7, which proposed python:3.15-rc-alpine). This takes the conservative path instead: - 3.13-slim is a released stable Python (3.15 is an unreleased release candidate; pinning production to an RC is not appropriate). - Stays on the Debian/glibc `-slim` line rather than switching to Alpine/musl, which would break manylinux wheels and risk the Django build (psycopg2 etc.). - 3.13 satisfies pyproject's `requires-python = ">=3.12"` and is supported by Django 5.2. Supersedes the Snyk PR #7.
Author
|
@siscia — flagging you for review (couldn't formally request it via the API since I'm contributing from a fork without triage rights on this repo). This is a conservative base-image CVE fix; it supersedes the Snyk bot's uw-ssec/llteacher#7, which proposed an unreleased |
Member
|
@cdcore09 , sorry - was off github for a while. llteacher works on top of: https://github.com/RedBeardLab/2llteacher This repo should be archived. |
Author
|
Gotcha! No worries. We are doing a deep security audit, and it flagged the container image.
… On Aug 6, 2026, at 9:41 AM, Simone Mosciatti ***@***.***> wrote:
siscia
left a comment
(RedBeardLab/llteacher#5)
<#5 (comment)>
@cdcore09 <https://github.com/cdcore09> , sorry - was off github for a while.
llteacher works on top of: https://github.com/RedBeardLab/2llteacher
This repo should be archived.
—
Reply to this email directly, view it on GitHub <#5?email_source=notifications&email_token=A6QN7VDPCRQKNUCU65ITNN35ISYL3A5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTKMRQG42TEMJRG44KM4TFMFZW63VHNVSW45DJN5XKKZLWMVXHJLDGN5XXIZLSL5RWY2LDNM#issuecomment-5207521178>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/A6QN7VA4WQ2UHEJGLHUUS7L5ISYL3AVCNFSNUABGKJSXA33TNF2G64TZHMYTANJVGM3TANJTGU5US43TOVSTWNJQGY4TSMZZGQ3TJILWAI>.
You are receiving this because you were mentioned.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Bumps the Docker base image from
python:3.12-slimtopython:3.13-slimto clear the 4 base-image CVEs Snyk flagged.Why not the Snyk-proposed
python:3.15-rc-alpineSnyk auto-opened uw-ssec/llteacher#7 proposing
python:3.15-rc-alpine. Two problems with that target:3.15-rcis an unreleased release candidate — production images shouldn't pin to a pre-release; Snyk's "0 known vulnerabilities" for an RC mostly means it hasn't been scanned yet.-slim→-alpineswitches Debian/glibc to musl, which breaks manylinux wheels (psycopg2 and other compiled deps) and risks the Django build.python:3.13-slimis the conservative fix: released stable, stays on glibc, satisfiespyproject'srequires-python = ">=3.12", is supported by Django 5.2, and clears the same base-image CVEs.Context
uw-ssec/llteacher(a fork) has migrated off this Django stack to a TypeScript/Cloudflare Workers stack, so this fix is contributed upstream where the Django Docker image is still in use. Supersedes the Snyk PR uw-ssec#7.