[Snyk] Security upgrade python from 3.11.8-slim-bookworm to 3.12.4-slim-bookworm #4224
Conversation
The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-DEBIAN12-SYSTEMD-6277507 - https://snyk.io/vuln/SNYK-DEBIAN12-SYSTEMD-6277507 - https://snyk.io/vuln/SNYK-DEBIAN12-OPENSSL-6048820 - https://snyk.io/vuln/SNYK-DEBIAN12-OPENSSL-6148845 - https://snyk.io/vuln/SNYK-DEBIAN12-OPENSSL-6190223
Deploying windmill with
|
| Latest commit: |
43ce5fa
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://bad13f7a.windmill.pages.dev |
| Branch Preview URL: | https://snyk-fix-c64e00b3b9a5bc5dc32.windmill.pages.dev |
![ellipsis-dev[bot]](https://avatars.githubusercontent.com/in/64358?s=60&v=4){kind=small}
There was a problem hiding this comment.
👍 Looks good to me! Reviewed everything up to 5905c9b in 27 seconds
More details
- Looked at
13lines of code in1files - Skipped
0files when reviewing. - Skipped posting
1drafted comments based on config settings.
1. Dockerfile:3
- Draft comment:
The update of the Python image from3.11.8-slim-bookwormto3.12.4-slim-bookwormis appropriate to address the security vulnerabilities listed. Ensure that the application's compatibility with Python 3.12.4 is tested, as minor version updates can sometimes introduce breaking changes or deprecations that could affect the application. - Reason this comment was not posted:
Confidence changes required:0%
The PR is intended to update the Python base image from version 3.11.8 to 3.12.4 to address security vulnerabilities. The change is straightforward and involves updating the version number in the Dockerfile. This is a typical and necessary update to keep the software dependencies secure and up-to-date. The PR description provided by Snyk outlines the vulnerabilities that are addressed by this update, which includes high and medium severity issues related to systemd and OpenSSL. The change does not appear to introduce any new issues or conflicts with existing configurations in the Dockerfile.
Workflow ID: wflow_Ft2LeGvCeSUx3FOu
You can customize Ellipsis with 👍 / 👎 feedback, review rules, user-specific overrides, quiet mode, and more.
🔍 Vulnerabilities of
|
| digest | sha256:8afa72a699ab39ef602492f7d5098f709522fec7c8c12cb714a719593a5c359b |
| vulnerabilities |     |
| size | 877 MB |
| packages | 1391 |
📦 Base Image python:3-slim
| also known as |
|
| digest | sha256:a074fac67aa01841fee592d00bae14d25dcaf98ef6e12a683ecceb7e0147e2d1 |
| vulnerabilities |    |
# Dockerfile (111:117)
RUN if [ "$WITH_HELM" = "true" ]; then \
arch="$(dpkg --print-architecture)"; arch="${arch##*-}"; \
wget "https://get.helm.sh/helm-v${HELM_VERSION}-linux-$arch.tar.gz" && \
tar -zxvf "helm-v${HELM_VERSION}-linux-$arch.tar.gz" && \
mv linux-$arch/helm /usr/local/bin/helm &&\
chmod +x /usr/local/bin/helm; \
else echo 'Building the image without helm'; fi
Description
Description
Description
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
# Dockerfile (93:95)
RUN apt-get update \
&& apt-get install -y ca-certificates wget curl git jq unzip build-essential unixodbc xmlsec1 software-properties-common \
&& rm -rf /var/lib/apt/lists/*
Description
Description
Description
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
# Dockerfile (111:117)
RUN if [ "$WITH_HELM" = "true" ]; then \
arch="$(dpkg --print-architecture)"; arch="${arch##*-}"; \
wget "https://get.helm.sh/helm-v${HELM_VERSION}-linux-$arch.tar.gz" && \
tar -zxvf "helm-v${HELM_VERSION}-linux-$arch.tar.gz" && \
mv linux-$arch/helm /usr/local/bin/helm &&\
chmod +x /usr/local/bin/helm; \
else echo 'Building the image without helm'; fi
Description
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
# Dockerfile (93:95)
RUN apt-get update \
&& apt-get install -y ca-certificates wget curl git jq unzip build-essential unixodbc xmlsec1 software-properties-common \
&& rm -rf /var/lib/apt/lists/*
Description
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
# Dockerfile (155:155)
COPY --from=builder /frontend/build /static_frontend
Description
Description
Description
Description
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
# Dockerfile (93:95)
RUN apt-get update \
&& apt-get install -y ca-certificates wget curl git jq unzip build-essential unixodbc xmlsec1 software-properties-common \
&& rm -rf /var/lib/apt/lists/*
Description
Description
Description
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
# Dockerfile (155:155)
COPY --from=builder /frontend/build /static_frontend
Description
Description
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
# Dockerfile (80:80)
FROM ${PYTHON_IMAGE}
Description
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
# Dockerfile (98:109)
RUN if [ "$WITH_POWERSHELL" = "true" ]; then \
if [ "$TARGETPLATFORM" = "linux/amd64" ]; then apt-get update -y && apt install libicu-dev -y && wget -O 'pwsh.deb' "https://github.com/PowerShell/PowerShell/releases/download/v${POWERSHELL_VERSION}/powershell_${POWERSHELL_DEB_VERSION}.deb_amd64.deb" && \
dpkg --install 'pwsh.deb' && \
rm 'pwsh.deb'; \
elif [ "$TARGETPLATFORM" = "linux/arm64" ]; then apt-get update -y && apt install libicu-dev -y && wget -O powershell.tar.gz "https://github.com/PowerShell/PowerShell/releases/download/v${POWERSHELL_VERSION}/powershell-${POWERSHELL_VERSION}-linux-arm64.tar.gz" && \
mkdir -p /opt/microsoft/powershell/7 && \
tar zxf powershell.tar.gz -C /opt/microsoft/powershell/7 && \
chmod +x /opt/microsoft/powershell/7/pwsh && \
ln -s /opt/microsoft/powershell/7/pwsh /usr/bin/pwsh && \
rm powershell.tar.gz; \
else echo 'Could not install pwshell, not on amd64 or arm64'; fi; \
else echo 'Building the image without powershell'; fi
Description
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
# Dockerfile (98:109)
RUN if [ "$WITH_POWERSHELL" = "true" ]; then \
if [ "$TARGETPLATFORM" = "linux/amd64" ]; then apt-get update -y && apt install libicu-dev -y && wget -O 'pwsh.deb' "https://github.com/PowerShell/PowerShell/releases/download/v${POWERSHELL_VERSION}/powershell_${POWERSHELL_DEB_VERSION}.deb_amd64.deb" && \
dpkg --install 'pwsh.deb' && \
rm 'pwsh.deb'; \
elif [ "$TARGETPLATFORM" = "linux/arm64" ]; then apt-get update -y && apt install libicu-dev -y && wget -O powershell.tar.gz "https://github.com/PowerShell/PowerShell/releases/download/v${POWERSHELL_VERSION}/powershell-${POWERSHELL_VERSION}-linux-arm64.tar.gz" && \
mkdir -p /opt/microsoft/powershell/7 && \
tar zxf powershell.tar.gz -C /opt/microsoft/powershell/7 && \
chmod +x /opt/microsoft/powershell/7/pwsh && \
ln -s /opt/microsoft/powershell/7/pwsh /usr/bin/pwsh && \
rm powershell.tar.gz; \
else echo 'Could not install pwshell, not on amd64 or arm64'; fi; \
else echo 'Building the image without powershell'; fi
Description
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
# Dockerfile (98:109)
RUN if [ "$WITH_POWERSHELL" = "true" ]; then \
if [ "$TARGETPLATFORM" = "linux/amd64" ]; then apt-get update -y && apt install libicu-dev -y && wget -O 'pwsh.deb' "https://github.com/PowerShell/PowerShell/releases/download/v${POWERSHELL_VERSION}/powershell_${POWERSHELL_DEB_VERSION}.deb_amd64.deb" && \
dpkg --install 'pwsh.deb' && \
rm 'pwsh.deb'; \
elif [ "$TARGETPLATFORM" = "linux/arm64" ]; then apt-get update -y && apt install libicu-dev -y && wget -O powershell.tar.gz "https://github.com/PowerShell/PowerShell/releases/download/v${POWERSHELL_VERSION}/powershell-${POWERSHELL_VERSION}-linux-arm64.tar.gz" && \
mkdir -p /opt/microsoft/powershell/7 && \
tar zxf powershell.tar.gz -C /opt/microsoft/powershell/7 && \
chmod +x /opt/microsoft/powershell/7/pwsh && \
ln -s /opt/microsoft/powershell/7/pwsh /usr/bin/pwsh && \
rm powershell.tar.gz; \
else echo 'Could not install pwshell, not on amd64 or arm64'; fi; \
else echo 'Building the image without powershell'; fi
Description
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
# Dockerfile (98:109)
RUN if [ "$WITH_POWERSHELL" = "true" ]; then \
if [ "$TARGETPLATFORM" = "linux/amd64" ]; then apt-get update -y && apt install libicu-dev -y && wget -O 'pwsh.deb' "https://github.com/PowerShell/PowerShell/releases/download/v${POWERSHELL_VERSION}/powershell_${POWERSHELL_DEB_VERSION}.deb_amd64.deb" && \
dpkg --install 'pwsh.deb' && \
rm 'pwsh.deb'; \
elif [ "$TARGETPLATFORM" = "linux/arm64" ]; then apt-get update -y && apt install libicu-dev -y && wget -O powershell.tar.gz "https://github.com/PowerShell/PowerShell/releases/download/v${POWERSHELL_VERSION}/powershell-${POWERSHELL_VERSION}-linux-arm64.tar.gz" && \
mkdir -p /opt/microsoft/powershell/7 && \
tar zxf powershell.tar.gz -C /opt/microsoft/powershell/7 && \
chmod +x /opt/microsoft/powershell/7/pwsh && \
ln -s /opt/microsoft/powershell/7/pwsh /usr/bin/pwsh && \
rm powershell.tar.gz; \
else echo 'Could not install pwshell, not on amd64 or arm64'; fi; \
else echo 'Building the image without powershell'; fi
Description
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
# Dockerfile (93:95)
RUN apt-get update \
&& apt-get install -y ca-certificates wget curl git jq unzip build-essential unixodbc xmlsec1 software-properties-common \
&& rm -rf /var/lib/apt/lists/*
Description
|
rubenfiszel
force-pushed
the
main
branch
3 times, most recently
from
413dad5
to
ad69876
Compare
rubenfiszel
force-pushed
the
main
branch
3 times, most recently
from
9a08368
to
779a788
Compare
rubenfiszel
force-pushed
the
main
branch
7 times, most recently
from
e80f43d
to
9c506a8
Compare
rubenfiszel
force-pushed
the
main
branch
3 times, most recently
from
ec6b974
to
8e0eb3d
Compare
rubenfiszel
force-pushed
the
main
branch
3 times, most recently
from
c7e985c
to
8867260
Compare
Snyk has created this PR to fix 4 vulnerabilities in the dockerfile dependencies of this project.
Keeping your Docker base image up-to-date means you’ll benefit from security fixes in the latest version of your chosen image.
Snyk changed the following file(s):
DockerfileWe recommend upgrading to
python:3.12.4-slim-bookworm, as this image has only 47 known vulnerabilities. To do this, merge this pull request, then verify your application still works as expected.Vulnerabilities that will be fixed with an upgrade:
SNYK-DEBIAN12-SYSTEMD-6277507
SNYK-DEBIAN12-SYSTEMD-6277507
SNYK-DEBIAN12-OPENSSL-6048820
SNYK-DEBIAN12-OPENSSL-6148845
SNYK-DEBIAN12-OPENSSL-6190223
Important
Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.
For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic
Learn how to fix vulnerabilities with free interactive lessons:
🦉 Allocation of Resources Without Limits or Throttling
Summary:
Update
Dockerfileto usepython:3.12.4-slim-bookwormto address security vulnerabilities.Key points:
Dockerfileto usepython:3.12.4-slim-bookworminstead ofpython:3.11.8-slim-bookworm.Generated with ❤️ by ellipsis.dev