From 8453a6255ed6372e603361225c2e61a671eae417 Mon Sep 17 00:00:00 2001 From: DoDiODev Date: Tue, 10 Nov 2026 13:58:51 +0100 Subject: [PATCH 1/2] build(python): move the Python runtime from 3.11 to 3.14 Raise the Python line in the backend and lake-builder images, the devcontainer Python feature, the pyproject constraints of pydevlake, the plugins and the test fakeplugin, the uv.sh default and the development docs. Python 3.11 reaches end of life in October 2027; 3.14 is supported until October 2030. The poetry.lock files only change in their python constraint and content-hash; no package version changes. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: DoDiODev --- .devcontainer/devcontainer.json | 2 +- backend/Dockerfile | 2 +- backend/python/DevelopmentSetup.md | 6 +++--- backend/python/plugins/azuredevops/poetry.lock | 6 +++--- backend/python/plugins/azuredevops/pyproject.toml | 2 +- backend/python/plugins/glpi/pyproject.toml | 2 +- backend/python/plugins/redmine/pyproject.toml | 2 +- backend/python/plugins/zephyr/pyproject.toml | 2 +- backend/python/pydevlake/poetry.lock | 4 ++-- backend/python/pydevlake/pyproject.toml | 2 +- backend/python/test/fakeplugin/poetry.lock | 6 +++--- backend/python/test/fakeplugin/pyproject.toml | 2 +- backend/python/uv.sh | 2 +- devops/docker/lake-builder/Dockerfile | 2 +- 14 files changed, 21 insertions(+), 21 deletions(-) diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json index e6564dd2f84..c6f26336ec0 100644 --- a/.devcontainer/devcontainer.json +++ b/.devcontainer/devcontainer.json @@ -24,7 +24,7 @@ "ghcr.io/jungaretti/features/make:1": {}, "ghcr.io/devcontainers/features/docker-in-docker:2.12.0": {}, "ghcr.io/devcontainers/features/python:1": { - "version": "3.11" + "version": "3.14" }, "ghcr.io/devcontainers-extra/features/poetry:2": {}, "ghcr.io/devcontainers/features/node:1": { diff --git a/backend/Dockerfile b/backend/Dockerfile index 078fcd17882..64a080da0b2 100644 --- a/backend/Dockerfile +++ b/backend/Dockerfile @@ -64,7 +64,7 @@ RUN --mount=type=cache,target=/root/.cache/go-build \ DEVLAKE_PLUGINS="$GO_PLUGINS" make all -FROM python:3.11-slim-bookworm as base +FROM python:3.14-slim-bookworm as base # apt-get upgrade picks up Debian security fixes that the base tag does not contain yet RUN apt-get update && \ diff --git a/backend/python/DevelopmentSetup.md b/backend/python/DevelopmentSetup.md index c171bd81dbf..e6fc7cd3985 100644 --- a/backend/python/DevelopmentSetup.md +++ b/backend/python/DevelopmentSetup.md @@ -22,9 +22,9 @@ limitations under the License. For the Python plugin tests to run properly, the following steps must be taken: 1. The following packages are required for Ubuntu: `libffi-dev default-libmysqlclient-dev libpq-dev` -2. `python3.11` is required by the time of this document. - - Try `deadsnakes` if you are using Ubuntu 22.04 or above, the `python3.11-dev` is required. - - Use `virtualenv` if you are having multiple python versions. `virtualenv -p python3.11 path/to/venv` and `source path/to/venv/bin/activate.sh` should do the trick +2. `python3.14` is required by the time of this document. + - Try `deadsnakes` if you are using Ubuntu 22.04 or above, the `python3.14-dev` is required. + - Use `virtualenv` if you are having multiple python versions. `virtualenv -p python3.14 path/to/venv` and `source path/to/venv/bin/activate.sh` should do the trick 3. both `mysql-client` and `postgresql` are required. - `postgresql` is required for `psycopg2` to work 4. [poetry](https://python-poetry.org/) is required. diff --git a/backend/python/plugins/azuredevops/poetry.lock b/backend/python/plugins/azuredevops/poetry.lock index 30a29cd71e5..d5762fa4fb6 100644 --- a/backend/python/plugins/azuredevops/poetry.lock +++ b/backend/python/plugins/azuredevops/poetry.lock @@ -665,7 +665,7 @@ name = "pydevlake" version = "0.1.0" description = "Devlake plugin framework" optional = false -python-versions = ">=3.11,<3.12" +python-versions = ">=3.14,<3.15" groups = ["main"] files = [] develop = true @@ -923,5 +923,5 @@ zstd = ["backports-zstd (>=1.0.0) ; python_version < \"3.14\""] [metadata] lock-version = "2.1" -python-versions = ">=3.11,<3.12" -content-hash = "78407e54fb2d2ddfe04ff90e562a064df550475a2d050282efebad9cdaaad7b1" +python-versions = ">=3.14,<3.15" +content-hash = "585a98a451fb48f967e77b1923277b16e279472ea34e7c9ea57a1cd95eb248e0" diff --git a/backend/python/plugins/azuredevops/pyproject.toml b/backend/python/plugins/azuredevops/pyproject.toml index b0ee7cf60a2..214b4940e0a 100644 --- a/backend/python/plugins/azuredevops/pyproject.toml +++ b/backend/python/plugins/azuredevops/pyproject.toml @@ -21,7 +21,7 @@ authors = ["Hezheng Yin "] readme = "README.md" [tool.poetry.dependencies] -python = ">=3.11,<3.12" +python = ">=3.14,<3.15" pydevlake = { path = "../../pydevlake", develop = true } diff --git a/backend/python/plugins/glpi/pyproject.toml b/backend/python/plugins/glpi/pyproject.toml index f76b45e530e..fd03345d000 100644 --- a/backend/python/plugins/glpi/pyproject.toml +++ b/backend/python/plugins/glpi/pyproject.toml @@ -21,7 +21,7 @@ authors = ["Roger Abelenda <3179183+rabelenda@users.noreply.github.com>"] readme = "README.md" [tool.poetry.dependencies] -python = ">=3.11,<3.12" +python = ">=3.14,<3.15" pydevlake = { path = "../../pydevlake", develop = true } [tool.poetry.group.dev.dependencies] diff --git a/backend/python/plugins/redmine/pyproject.toml b/backend/python/plugins/redmine/pyproject.toml index aa1b847ecb0..e4fe9e836c3 100644 --- a/backend/python/plugins/redmine/pyproject.toml +++ b/backend/python/plugins/redmine/pyproject.toml @@ -21,7 +21,7 @@ authors = ["Roger Abelenda <3179183+rabelenda@users.noreply.github.com>"] readme = "README.md" [tool.poetry.dependencies] -python = ">=3.11,<3.12" +python = ">=3.14,<3.15" pydevlake = { path = "../../pydevlake", develop = true } [tool.poetry.group.dev.dependencies] diff --git a/backend/python/plugins/zephyr/pyproject.toml b/backend/python/plugins/zephyr/pyproject.toml index e896bcc5142..9a49a60f124 100644 --- a/backend/python/plugins/zephyr/pyproject.toml +++ b/backend/python/plugins/zephyr/pyproject.toml @@ -21,7 +21,7 @@ authors = ["Roger Abelenda <3179183+rabelenda@users.noreply.github.com>"] readme = "README.md" [tool.poetry.dependencies] -python = ">=3.11,<3.12" +python = ">=3.14,<3.15" pydevlake = { path = "../../pydevlake", develop = true } [tool.poetry.group.dev.dependencies] diff --git a/backend/python/pydevlake/poetry.lock b/backend/python/pydevlake/poetry.lock index b366bd1a612..8c96666ffd2 100644 --- a/backend/python/pydevlake/poetry.lock +++ b/backend/python/pydevlake/poetry.lock @@ -950,5 +950,5 @@ zstd = ["backports-zstd (>=1.0.0) ; python_version < \"3.14\""] [metadata] lock-version = "2.1" -python-versions = ">=3.11,<3.12" -content-hash = "ba760004b773bc1f0854c85809c957d1d8ea9cb1eccc901305694c9d7de8417d" +python-versions = ">=3.14,<3.15" +content-hash = "41e368d4489d2fbbefd15d0a484ef849340b6c17ef03ba151cb237ab83a9ecb5" diff --git a/backend/python/pydevlake/pyproject.toml b/backend/python/pydevlake/pyproject.toml index fa759d94098..d8f7a9277e7 100644 --- a/backend/python/pydevlake/pyproject.toml +++ b/backend/python/pydevlake/pyproject.toml @@ -22,7 +22,7 @@ license = "Apache-2.0" readme = "README.md" [tool.poetry.dependencies] -python = ">=3.11,<3.12" +python = ">=3.14,<3.15" sqlmodel = "^0.0.38" mysqlclient = "^2.1.1" requests = "^2.28.1" diff --git a/backend/python/test/fakeplugin/poetry.lock b/backend/python/test/fakeplugin/poetry.lock index ec6782adcd7..cd60bf838b5 100644 --- a/backend/python/test/fakeplugin/poetry.lock +++ b/backend/python/test/fakeplugin/poetry.lock @@ -665,7 +665,7 @@ name = "pydevlake" version = "0.1.0" description = "Devlake plugin framework" optional = false -python-versions = ">=3.11,<3.12" +python-versions = ">=3.14,<3.15" groups = ["main"] files = [] develop = true @@ -923,5 +923,5 @@ zstd = ["backports-zstd (>=1.0.0) ; python_version < \"3.14\""] [metadata] lock-version = "2.1" -python-versions = ">=3.11,<3.12" -content-hash = "5db22af317d36524b8188aa25d13fdb3861e379699f4eb86944e7bb58c79f49a" +python-versions = ">=3.14,<3.15" +content-hash = "34b1d9618c6f82658528288fee62f704db6e673f5dc7a6e5d8650b54ee727468" diff --git a/backend/python/test/fakeplugin/pyproject.toml b/backend/python/test/fakeplugin/pyproject.toml index d72afa4f9b3..2c90b8ec269 100644 --- a/backend/python/test/fakeplugin/pyproject.toml +++ b/backend/python/test/fakeplugin/pyproject.toml @@ -20,7 +20,7 @@ description = "Fake python plugin used only in tests" authors = [] [tool.poetry.dependencies] -python = ">=3.11,<3.12" +python = ">=3.14,<3.15" pydevlake = { path = "../../pydevlake", develop = true } diff --git a/backend/python/uv.sh b/backend/python/uv.sh index b775b9787c0..da4eff3cbc2 100755 --- a/backend/python/uv.sh +++ b/backend/python/uv.sh @@ -50,7 +50,7 @@ sync_project() { rm -rf .venv fi if [ ! -x .venv/bin/python ]; then - uv venv --python "${DEVLAKE_PYTHON_VERSION:-3.11}" .venv + uv venv --python "${DEVLAKE_PYTHON_VERSION:-3.14}" .venv fi uv pip install --python .venv/bin/python -e . } diff --git a/devops/docker/lake-builder/Dockerfile b/devops/docker/lake-builder/Dockerfile index 9c96447895a..47e60f26fef 100644 --- a/devops/docker/lake-builder/Dockerfile +++ b/devops/docker/lake-builder/Dockerfile @@ -18,7 +18,7 @@ FROM ghcr.io/astral-sh/uv:0.13.7 AS uv # Same Python line as the runtime image in backend/Dockerfile. -FROM python:3.11-slim-bookworm +FROM python:3.14-slim-bookworm RUN apt -y update && apt -y upgrade && apt -y install tzdata make tar curl gcc g++ pkg-config git \ zlib1g libffi-dev \ From 88d3294e77781aabb978d917de7183f2293c73ce Mon Sep 17 00:00:00 2001 From: DoDiODev Date: Wed, 11 Nov 2026 16:53:31 +0100 Subject: [PATCH 2/2] build(docker): move the backend images from bookworm to trixie Debian 12 (bookworm) has left regular security support and is only covered by Debian LTS until June 2028. Move the remaining bookworm base images to Debian 13 (trixie): the backend builder and runtime stages, Dockerfile.local (builder and runtime together, since its binary is linked against the builder's glibc), the lake-builder image and the devcontainer. config-ui is left out; its builder stage moves with the Node 26 update. trixie's /etc/login.defs sets HOME_MODE 0700, so `useradd -m` would now create /app as 0700 and a container started with a random UID (as on OpenShift) could no longer enter it. Pass HOME_MODE=0755 to keep the bookworm behaviour. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: DoDiODev --- .devcontainer/Dockerfile | 2 +- backend/Dockerfile | 7 ++++--- backend/Dockerfile.local | 6 +++--- devops/docker/lake-builder/Dockerfile | 2 +- 4 files changed, 9 insertions(+), 8 deletions(-) diff --git a/.devcontainer/Dockerfile b/.devcontainer/Dockerfile index e795825084f..0bdfbd38b85 100644 --- a/.devcontainer/Dockerfile +++ b/.devcontainer/Dockerfile @@ -13,7 +13,7 @@ # See the License for the specific language governing permissions and # limitations under the License. -FROM mcr.microsoft.com/devcontainers/go:2-1.27-bookworm +FROM mcr.microsoft.com/devcontainers/go:2-1.27-trixie ENV DEVLAKE_PLUGINS=argocd,bamboo,bitbucket,circleci,customize,dora,gitextractor,github,github_graphql,gitlab,issue_trace,jenkins,jira,org,pagerduty,refdiff,slack,sonarqube,trello,webhook diff --git a/backend/Dockerfile b/backend/Dockerfile index 64a080da0b2..a8a3b230836 100644 --- a/backend/Dockerfile +++ b/backend/Dockerfile @@ -28,7 +28,7 @@ # pinned and Dependabot keeps it current through this FROM line. FROM ghcr.io/astral-sh/uv:0.13.7 as uv -FROM --platform=$BUILDPLATFORM golang:1.27-bookworm as builder +FROM --platform=$BUILDPLATFORM golang:1.27-trixie as builder # docker build --build-arg GOPROXY=https://goproxy.io,direct -t mericodev/lake . ARG GOPROXY= @@ -64,7 +64,7 @@ RUN --mount=type=cache,target=/root/.cache/go-build \ DEVLAKE_PLUGINS="$GO_PLUGINS" make all -FROM python:3.14-slim-bookworm as base +FROM python:3.14-slim-trixie as base # apt-get upgrade picks up Debian security fixes that the base tag does not contain yet RUN apt-get update && \ @@ -85,7 +85,8 @@ RUN apt-get update && \ EXPOSE 8080 -RUN useradd -ms /bin/bash -d /app devlake -u 1010 -G 0 +# trixie's login.defs sets HOME_MODE 0700; keep /app traversable for a random UID. +RUN useradd -ms /bin/bash -d /app -K HOME_MODE=0755 devlake -u 1010 -G 0 RUN chown -R devlake:devlake /etc/ssl/certs USER devlake ENV PYTHONUNBUFFERED=1 diff --git a/backend/Dockerfile.local b/backend/Dockerfile.local index 7540e8b5e4e..0e7dd320f9d 100644 --- a/backend/Dockerfile.local +++ b/backend/Dockerfile.local @@ -23,7 +23,7 @@ #While incubation status is not necessarily a reflection of the completeness or stability of the code, #it does indicate that the project has yet to be fully endorsed by the ASF. -FROM golang:1.27-bookworm as builder +FROM golang:1.27-trixie as builder ARG GOPROXY= ARG HTTP_PROXY= @@ -65,13 +65,13 @@ RUN --mount=type=cache,target=/root/.cache/go-build \ --mount=type=cache,target=/go/pkg/mod \ VERSION=${TAG}@${SHA} make build -FROM debian:bookworm-slim +FROM debian:trixie-slim RUN apt-get update && apt-get install -y \ ca-certificates \ # gitextractor shells out to the git CLI, so the binary must be present or # every clone fails with "git: executable file not found in $PATH". - # debian:bookworm-slim does not ship it; the official image inherits it from + # debian:trixie-slim does not ship it; the official image inherits it from # its python base. git \ && rm -rf /var/lib/apt/lists/* diff --git a/devops/docker/lake-builder/Dockerfile b/devops/docker/lake-builder/Dockerfile index 47e60f26fef..7f9ed9fe36d 100644 --- a/devops/docker/lake-builder/Dockerfile +++ b/devops/docker/lake-builder/Dockerfile @@ -18,7 +18,7 @@ FROM ghcr.io/astral-sh/uv:0.13.7 AS uv # Same Python line as the runtime image in backend/Dockerfile. -FROM python:3.14-slim-bookworm +FROM python:3.14-slim-trixie RUN apt -y update && apt -y upgrade && apt -y install tzdata make tar curl gcc g++ pkg-config git \ zlib1g libffi-dev \