Repository navigation
build(docker): run the container image on Python 3.15 - #1538
Merged
Merged
Conversation
Move the builder and final images to python:3.15.0 (trixie and alpine3.24) and the astral/uv tool images to 0.13.1-python3.15. All pins were checked against the registry with crane. Python 3.15.0 carries the fixes for CVE-2026-87910 (tarfile, python/cpython#157309), CVE-2025-15367 (poplib, #143924) and CVE-2026-12345 (tempfile, #158431), so their .grype.yaml entries go. Grype still reports CVE-2025-15367 against 3.15.0: NVD's bound is < 3.15.0a6 and grype's generic version ordering ranks the 3.15.0 final before that alpha. Keep a single ignore for it, scoped to python 3.15.0, until CI's grype includes anchore/grype#3776. Signed-off-by: Jürgen Kreileder <jk@blackdown.de>
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
📜 Recent review details
WalkthroughThe builder, uv tool, and final Alpine images move to Python 3.15. The Grype ignore list and v1.5.0 changelog are updated to reflect the image version and related vulnerability information. ChangesPython 3.15 image update
Priority: ⬇️ Low Estimated code review effort: 2 (Simple) | ~10 minutes Change: Feature Merge Risk: ⚪ Minimal · up to
|
| Check name | Status | Explanation |
|---|---|---|
| Title check |  |
The title clearly and concisely describes the primary change: running the container image on Python 3.15. |
| Description check | |
The description includes complete Summary, Security, and Testing sections. It explains the image updates, Grype ignore changes, security impact, validation steps, and tracked issues. |
| Docstring Coverage | |
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0… |
| Linked Issues check | |
Check skipped because no linked issues were found for this pull request. |
| Out of Scope Changes check | |
Check skipped because no linked issues were found for this pull request. |
✨ Finishing Touches
-
🧪 Generate unit tests (beta)
-
- Commit to this branch
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
I’m a rabbit with a carrot to spare,
Python 3.15 is now in the air.
The image notes list what moved along,
One scoped ignore keeps its place in the song.
I hop through the changelog, then nibble with care.
Comment @coderabbitai help to get the list of available commands.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #1538 +/- ##
=========================================
Coverage 100.00% 100.00%
=========================================
Files 8 8
Lines 268 268
Branches 31 31
=========================================
Hits 268 268
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. |
🔍 Vulnerabilities of
|
| digest | sha256:c1bfa9322e8c9ec34001c3b269851f7059b4101f783331e374960e8011528a86 |
| vulnerabilities |     |
| platform | linux/amd64 |
| size | 28 MB |
| packages | 62 |
📦 Base Image python:3-alpine
| also known as |
|
| digest | sha256:9ab1d4f3e45b370553a5b665766c5fd3c595d279fed7fc867d7ed18d62595fd4 |
| vulnerabilities |   |
Recommended fixes for image
|
| Name | 3.15.0-alpine3.24 |
| Digest | sha256:9ab1d4f3e45b370553a5b665766c5fd3c595d279fed7fc867d7ed18d62595fd4 |
| Vulnerabilities | |
| Pushed | 1 day ago |
| Size | 21 MB |
| Packages | 59 |
| Flavor | alpine |
| OS | 3.24 |
| Runtime | 3.15.0 |
The base image is also available under the supported tag(s):3-alpine3.24,3.15-alpine,3.15-alpine3.24,3.15.0-alpine,3.15.0-alpine3.24,alpine,alpine3.24
Refresh base image
Rebuild the image using a newer base image version. Updating this may result in breaking changes.✅ This image version is up to date.
Change base image
✅ There are no tag recommendations at this time.
Overview
Environment Variables (2 changes)
PATH=/usr/local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
PYTHONDONTWRITEBYTECODE=1
PYTHONFAULTHANDLER=1
-PYTHON_SHA256=c2215904f02b175596dc49351585104f4bc20341e1c47378b26a2c274360ce73
+PYTHON_SHA256=ba4bed1ba346b916890b76d9e320451420aa69f6408997d33c66482eeae3d575
-PYTHON_VERSION=3.14.8
+PYTHON_VERSION=3.15.0Labels (3 changes)
-org.opencontainers.image.created=2026-10-07T17:57:54.745Z
+org.opencontainers.image.created=2026-10-14T16:32:16.190Z
org.opencontainers.image.description=Update Hetzner Cloud firewall rules with current Cloudflare IP ranges
org.opencontainers.image.licenses=MIT
-org.opencontainers.image.revision=d2dc7be89c4f19368ab8411839e178b20c551006
+org.opencontainers.image.revision=f3725b4247bace09cbdfa1fd31e0a627cf54a105
org.opencontainers.image.source=https://github.com/jkreileder/cf-ips-to-hcloud-fw
org.opencontainers.image.title=cf-ips-to-hcloud-fw
org.opencontainers.image.url=https://github.com/jkreileder/cf-ips-to-hcloud-fw
-org.opencontainers.image.version=1.4.7
+org.opencontainers.image.version=pr-1538Policies (0 improved, 1 worsened)Health score:
Packages and Vulnerabilities (5 package changes and 0 vulnerability changes)
Changes for packages of type
|
| Package | Versionjkreileder/cf-ips-to-hcloud-fw:1 |
Versionquay.io/jkreileder/cf-ips-to-hcloud-fw:pr-1538 |
|
|---|---|---|---|
| ♾️ | .python-rundeps | 20261001.213612 |
20261012.223009 |
Changes for packages of type generic (1 changes)
| Package | Versionjkreileder/cf-ips-to-hcloud-fw:1 |
Versionquay.io/jkreileder/cf-ips-to-hcloud-fw:pr-1538 |
|
|---|---|---|---|
| ♾️ | python | 3.14.8 |
3.15.0 |
Changes for packages of type pypi (3 changes)
| Package | Versionjkreileder/cf-ips-to-hcloud-fw:1 |
Versionquay.io/jkreileder/cf-ips-to-hcloud-fw:pr-1538 |
|
|---|---|---|---|
| ♾️ | cf-ips-to-hcloud-fw | 1.4.7 |
1.5.0.dev1 |
| ♾️ | pydantic | 2.13.5 |
2.14.0 |
| ♾️ | pydantic-core | 2.46.5 |
2.50.0 |
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This is the follow-up to #1533, now that the final Python 3.15 images are on Docker Hub.
Images
python:3.15.0-trixieandpython:3.15.0-alpine3.24.astral/uvtool images move to0.13.1-python3.15-{trixie,alpine3.23}. uv publishes noalpine3.24variant, and that stage only supplies theuvbinary.crane digest. Both uv images reportPYTHON_VERSION=3.15.0.Grype ignores (tracked in #1412)
tempfile.TemporaryDirectory(GH-157580) python/cpython#158431. Ignore removed.< 3.15.0a6, and grype's generic version ordering puts the3.15.0final release before that alpha. This is the false positive described in fix: compare CPython CPE versions using Python ordering anchore/grype#3776, which is still open. The ignore stays with a new reason and removal condition, scoped toversion: 3.15.0so a later 3.15.x is scanned normally.Security
The container image no longer ships the three CPython CVEs above, which affect the v1.4.7 image's 3.14.8 interpreter. There is no token, secret or firewall-rule impact.
Testing
docker buildx buildpassed. The build stage runs ruff, ty and pytest on 3.15.0.--versionprints1.5.0.dev1.--only-fixedand the new.grype.yaml: no vulnerabilities. With--show-suppressed, the only CPython match is the scoped CVE-2025-15367. CVE-2026-19672, on Remove .grype.yaml CVE-2025-15367 ignore (removed in #1556; close once merged) #1412's watch list, no longer matches.Summary by CodeRabbit