Repository navigation
fix(container): bump Python base image to 3.12.16 - #13215
Conversation
|
✅ All required changelog fragments are present. |
|
✅ No Conflicts No conflict markers, and the branch merges cleanly into its base. |
|
No actionable comments were generated in the recent review.
 |
| Layer / File(s) | Summary |
|---|---|
Base image pins and changelog entries Dockerfile, api/Dockerfile, api/changelog.d/api-python-3.12.16.security.md, prowler/changelog.d/sdk-python-3.12.16.security.md |
The root and API Dockerfiles use Python 3.12.16 slim Trixie images with updated pinned digests. The API and SDK changelogs identify CVE-2026-115557 as patched. |
Priority:
Estimated code review effort: 2 (Simple) | ~10 minutes
Suggested reviewers: alejandrobailo
Merge Risk: 
ac289
-
The Python patch update has no identified merge-blocking issue and is mergeable subject to normal build and image checks.
Pre-merge checks: 
-
Check name Status Explanation Title check The title clearly and concisely describes the main change: updating the container Python base image to version 3.12.16. Description check The description includes the required context, change summary, review steps, checklist, and license confirmation. It also documents the SDK and API changelog fragments and reports validation results f… Docstring Coverage No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat… Linked Issues check Check skipped because no linked issues were found for this pull request. Out of Scope Changes check Check skipped because no linked issues were found for this pull request. Full details: Description check
-
Explanation
The description includes the required context, change summary, review steps, checklist, and license confirmation. It also documents the SDK and API changelog fragments and reports validation results for the SDK image.
Full details: Docstring Coverage
-
Explanation
No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (4 skipped: 4 unsupported.)
-
Finishing Touches
-
🧪 Generate unit tests (beta)
-
- Commit to this branch
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
🔒 Container Security ScanImage: ✅ No Vulnerabilities DetectedThe container image passed all security checks. No known CVEs were found.📋 Resources:
|
🔒 Container Security ScanImage: ✅ No Vulnerabilities DetectedThe container image passed all security checks. No known CVEs were found.📋 Resources:
|
🔎 Container Security Scan (Grype)Image: ✅ Nothing BlockingNo findings at critical or high severity. Not blocking at this cutoff — medium: 21, low: 7, negligible: 1. 82 finding(s) excluded by 📋 Resources:
|
🔎 Container Security Scan (Grype)Image: ✅ Nothing BlockingNo findings at critical or high severity. Not blocking at this cutoff — medium: 21, low: 7, negligible: 1. 60 finding(s) excluded by 📋 Resources:
|
Context
The SDK and API container images are built on
python:3.12.15-slim-trixie. The Grype database now flags the bundled CPython 3.12.15 interpreter with a critical CVE fixed in 3.12.16, sosdk-container-build-and-scanfails on every PR that builds the image, regardless of what the PR changes. The API image uses the same base and is affected the same way.Description
Both
Dockerfileandapi/Dockerfilemove topython:3.12.16-slim-trixie, pinned by its multi-arch index digest. Nothing else in the images changes. One changelog fragment is added for the SDK and one for the API.Steps to review
Build the SDK image and scan it the way CI does:
Locally the scan reports no critical or high findings and the Python CVE is gone;
docker run --rm --entrypoint python prowler:py31216 --versionprintsPython 3.12.16.Checklist
Community Checklist
SDK/CLI
UI
API
MCP Server
License
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
Summary by CodeRabbit