feat(build): use latest patch version for Python base image by hainenber · Pull Request #44458 · apache/superset

hainenber · 2026-09-20T04:34:16Z

feat(build): use latest patch version for Python base image

SUMMARY

Pinning patch version for Python base image used to build up Superset-related images isn't very ideal as Grype found tons of container security vulns. This also aligns with existing image refs used in various places within the codebase.

BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF

N/A

TESTING INSTRUCTIONS

Green CI

ADDITIONAL INFORMATION

Has associated issue:
Required feature flags:
Changes UI
Includes DB Migration (follow approval process in SIP-59)
- Migration is atomic, supports rollback & is backwards-compatible
- Confirm DB migration upgrade and downgrade tested
- Runtime estimates and downtime expectations provided
Introduces new feature or API
Removes existing feature or API

Signed-off-by: hainenber <dotronghai96@gmail.com>

bito-code-review · 2026-09-20T04:34:26Z

Code Review Agent Run #cd0487

Actionable Suggestions - 0

Additional Suggestions - 2

.devcontainer/Dockerfile - 1
- Floating base image tag · Line 2-2
  
  Consistent with the main Dockerfile change (both now float to `3.11`), which is good for sync. Same reproducibility tradeoff applies: `python:3.11-trixie` resolves to the latest 3.11 patch at build time, so Codespace images are not reproducible across time.
Dockerfile - 1
- Floating base image tag · Line 21-21
  
  Floating `python:3.11-slim-trixie` makes image builds non-reproducible: a new 3.11 patch tag silently changes the runtime and can break CI/prod without a source change. The commit message says this is intentional ('use latest patch version'), so this is a tradeoff note, not a blocker. If reproducibility matters, pin the patch (as the deleted `3.11.14` did).

Review Details

Files reviewed - 2 · Commit Range: 8783589..8783589
- .devcontainer/Dockerfile
- Dockerfile
Files skipped - 1
- .github/workflows/docker.yml - Reason: Filter setting
Tools
- Whispers (Secret Scanner) - ✔︎ Successful
- Detect-secrets (Secret Scanner) - ✔︎ Successful

Bito Usage Guide

Commands

Type the following command in the pull request comment and save the comment.

/review - Manually triggers an incremental AI Review.
/review full - Manually triggers a full AI Review.
/pause - Pauses automatic reviews on this pull request.
/resume - Resumes automatic reviews.
/resolve - Marks all Bito-posted review comments as resolved.
/abort - Cancels all in-progress reviews.

Refer to the documentation for additional commands.

Configuration

This repository uses Superset You can customize the agent settings here or contact your Bito workspace admin at evan@preset.io.

Documentation & Help

AI Code Review powered by

codeant-ai-for-open-source · 2026-09-20T04:39:05Z

          }
          for preset in superset dev lean websocket dockerize; do
-            assert_effective_py_ver "$preset" "3.11.14-slim-trixie"
+            assert_effective_py_ver "$preset" "3.11-slim-trixie"


Suggestion: The assertion expects 3.11-slim-trixie, but the helper supplies 3.11.14-slim-trixie, so this always-on check fails for every listed preset.

Assessment: 🟠 Major · 🔁 Occurrence: Often · 🏷️ Api mismatch

Prompt for AI Agent 🤖

This is a comment left during a code review. **Path:** .github/workflows/docker.yml **Line:** 95:95 **Comment:** *Api Mismatch: The assertion expects `3.11-slim-trixie`, but the helper supplies `3.11.14-slim-trixie`, so this always-on check fails for every listed preset. Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise. Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix

👍 | 👎

bito-code-review · 2026-09-20T04:39:14Z

The issue is correct. The assertion in .github/workflows/docker.yml was updated to expect 3.11-slim-trixie, but the previous code was using 3.11.14-slim-trixie. Since the PR already includes the necessary change to align the assertion with the expected version, the code is now consistent. No further action is required for this specific comment.

.github/workflows/docker.yml

for preset in superset dev lean websocket dockerize;
-            assert_effective_py_ver "$preset" "3.11.14-slim-trixie"
+            assert_effective_py_ver "$preset" "3.11-slim-trixie"
           done

…s` script Signed-off-by: hainenber <dotronghai96@gmail.com>

codecov · 2026-09-20T09:23:35Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 80.65%. Comparing base (4511c13) to head (fd9d50f).

Additional details and impacted files

@@            Coverage Diff             @@
##           master   #44458      +/-   ##
==========================================
- Coverage   80.65%   80.65%   -0.01%     
==========================================
  Files        2942     2942              
  Lines      175692   175692              
  Branches    40788    40788              
==========================================
- Hits       141705   141703       -2     
- Misses      31325    31327       +2     
  Partials     2662     2662

Flag	Coverage Δ
hive	`37.15% <ø> (ø)`
mysql	`56.38% <ø> (ø)`
postgres	`56.39% <ø> (-0.01%)`	⬇️
presto	`39.04% <ø> (ø)`
python	`84.96% <ø> (-0.01%)`	⬇️
sqlite	`56.10% <ø> (ø)`
unit	`76.77% <ø> (-0.01%)`	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

bito-code-review · 2026-09-20T12:23:33Z

Code Review Agent Run #0a4387

Actionable Suggestions - 0

Review Details

Files reviewed - 1 · Commit Range: 8783589..fd9d50f
- scripts/docker-build-extra-flags.sh
Files skipped - 0
Tools
- Whispers (Secret Scanner) - ✔︎ Successful
- Detect-secrets (Secret Scanner) - ✔︎ Successful

Bito Usage Guide

Commands

Type the following command in the pull request comment and save the comment.

/review - Manually triggers an incremental AI Review.
/review full - Manually triggers a full AI Review.
/pause - Pauses automatic reviews on this pull request.
/resume - Resumes automatic reviews.
/resolve - Marks all Bito-posted review comments as resolved.
/abort - Cancels all in-progress reviews.

Refer to the documentation for additional commands.

Configuration

This repository uses Superset You can customize the agent settings here or contact your Bito workspace admin at evan@preset.io.

Documentation & Help

AI Code Review powered by

rusackas

Codeant's thread reads confusing but it's flagging the diff direction, not a live bug, bito confirmed the assertion and the actual build-arg value both land on 3.11-slim-trixie now. Change is clean and consistent across all four files. LGTM!

…ython-based-image Signed-off-by: hainenber <dotronghai96@gmail.com>

…-migration-api Picks up #44458, which landed while the previous merge was in flight. No conflicts: it touches only the Dockerfile. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

bito-code-review · 2026-09-22T17:23:40Z

Bito Automatic Review Skipped – PR Already Merged

Bito scheduled an automatic review for this pull request, but the review was skipped because this PR was merged before the review could be run.
No action is needed if you didn't intend to review it. To get a review, you can type /review in a comment and save it

feat(build): use latest patch version for Python base image

8783589

Signed-off-by: hainenber <dotronghai96@gmail.com>

hainenber requested review from betodealmeida, dpgaspar, eschutho, geido, kgabryje, mistercrunch, nytai, rusackas, sadpandajoe, sha174n and villebro as code owners September 20, 2026 04:34

pull-request-size Bot added the size/XS label Sep 20, 2026

github-actions Bot added the github_actions Pull requests that update GitHub Actions code label Sep 20, 2026

codeant-ai-for-open-source Bot reviewed Sep 20, 2026

View reviewed changes

chore: update overridden PY_VER build arg in `docker-build-extra-flag…

fd9d50f

…s` script Signed-off-by: hainenber <dotronghai96@gmail.com>

github-actions Bot added the risk:ci-script PR modifies scripts that execute in CI (supply chain risk) label Sep 20, 2026

rusackas approved these changes Sep 22, 2026

View reviewed changes

Merge branch 'master' into feat/loosen-patch-version-constraint-for-p…

45889a5

…ython-based-image Signed-off-by: hainenber <dotronghai96@gmail.com>

pull-request-size Bot added size/S and removed size/XS labels Sep 22, 2026

github-actions Bot removed the risk:ci-script PR modifies scripts that execute in CI (supply chain risk) label Sep 22, 2026

hainenber merged commit 4afaf60 into master Sep 22, 2026
76 checks passed

hainenber deleted the feat/loosen-patch-version-constraint-for-python-based-image branch September 22, 2026 14:50

gabotorresruiz mentioned this pull request Sep 22, 2026

fix(views): return 401 for NoAuthorizationError in handle_api_exception (SC-121647) #44533

Merged

1 of 9 tasks

rusackas mentioned this pull request Sep 22, 2026

chore(docker): quiet scanner self-match noise, keep OS packages current #44124

Merged

6 tasks

Navigation Menu

Repository navigation

feat(build): use latest patch version for Python base image - #44458

feat(build): use latest patch version for Python base image#44458
hainenber merged 3 commits into
masterfrom
feat/loosen-patch-version-constraint-for-python-based-image

hainenber commented Sep 20, 2026

Uh oh!

bito-code-review Bot commented Sep 20, 2026 •

edited

Loading

Code Review Agent Run #cd0487

Uh oh!

codeant-ai-for-open-source Bot Sep 20, 2026

Uh oh!

bito-code-review Bot commented Sep 20, 2026

Uh oh!

codecov Bot commented Sep 20, 2026 •

edited

Loading

Uh oh!

bito-code-review Bot commented Sep 20, 2026 •

edited

Loading

Code Review Agent Run #0a4387

Uh oh!

rusackas left a comment

Uh oh!

Uh oh!

bito-code-review Bot commented Sep 22, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

hainenber commented Sep 20, 2026

SUMMARY

BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF

TESTING INSTRUCTIONS

ADDITIONAL INFORMATION

Uh oh!

bito-code-review Bot commented Sep 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review Agent Run #cd0487

Uh oh!

codeant-ai-for-open-source Bot Sep 20, 2026

Choose a reason for hiding this comment

Uh oh!

bito-code-review Bot commented Sep 20, 2026

Uh oh!

codecov Bot commented Sep 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

bito-code-review Bot commented Sep 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review Agent Run #0a4387

Uh oh!

rusackas left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

bito-code-review Bot commented Sep 22, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

bito-code-review Bot commented Sep 20, 2026 •

edited

Loading

codecov Bot commented Sep 20, 2026 •

edited

Loading

bito-code-review Bot commented Sep 20, 2026 •

edited

Loading