build: move the backend images to Debian trixie and Python 3.14

.devcontainer/Dockerfile

@@ -13,7 +13,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-FROM mcr.microsoft.com/devcontainers/go:2-1.27-bookworm
+FROM mcr.microsoft.com/devcontainers/go:2-1.27-trixie
 
 ENV DEVLAKE_PLUGINS=argocd,bamboo,bitbucket,circleci,customize,dora,gitextractor,github,github_graphql,gitlab,issue_trace,jenkins,jira,org,pagerduty,refdiff,slack,sonarqube,trello,webhook
 

.devcontainer/devcontainer.json

@@ -24,7 +24,7 @@
     "ghcr.io/jungaretti/features/make:1": {},
     "ghcr.io/devcontainers/features/docker-in-docker:2.12.0": {},
     "ghcr.io/devcontainers/features/python:1": {
-      "version": "3.11"
+      "version": "3.14"
     },
     "ghcr.io/devcontainers-extra/features/poetry:2": {},
     "ghcr.io/devcontainers/features/node:1": {

backend/Dockerfile

@@ -28,7 +28,7 @@
 # pinned and Dependabot keeps it current through this FROM line.
 FROM ghcr.io/astral-sh/uv:0.13.7 as uv
 
-FROM --platform=$BUILDPLATFORM golang:1.27-bookworm as builder
+FROM --platform=$BUILDPLATFORM golang:1.27-trixie as builder
 
 # docker build --build-arg GOPROXY=https://goproxy.io,direct -t mericodev/lake .
 ARG GOPROXY=
@@ -64,7 +64,7 @@ RUN --mount=type=cache,target=/root/.cache/go-build \
     DEVLAKE_PLUGINS="$GO_PLUGINS" make all
 
 
-FROM python:3.11-slim-bookworm as base
+FROM python:3.14-slim-trixie as base
 
 # apt-get upgrade picks up Debian security fixes that the base tag does not contain yet
 RUN apt-get update && \
@@ -85,7 +85,8 @@ RUN apt-get update && \
 
 EXPOSE 8080
 
-RUN useradd -ms /bin/bash -d /app devlake -u 1010 -G 0
+# trixie's login.defs sets HOME_MODE 0700; keep /app traversable for a random UID.
+RUN useradd -ms /bin/bash -d /app -K HOME_MODE=0755 devlake -u 1010 -G 0
 RUN chown -R devlake:devlake /etc/ssl/certs
 USER devlake
 ENV PYTHONUNBUFFERED=1

backend/Dockerfile.local

@@ -23,7 +23,7 @@
 #While incubation status is not necessarily a reflection of the completeness or stability of the code,
 #it does indicate that the project has yet to be fully endorsed by the ASF.
 
-FROM golang:1.27-bookworm as builder
+FROM golang:1.27-trixie as builder
 
 ARG GOPROXY=
 ARG HTTP_PROXY=
@@ -65,13 +65,13 @@ RUN --mount=type=cache,target=/root/.cache/go-build \
     --mount=type=cache,target=/go/pkg/mod \
     VERSION=${TAG}@${SHA} make build
 
-FROM debian:bookworm-slim
+FROM debian:trixie-slim
 
 RUN apt-get update && apt-get install -y \
     ca-certificates \
     # gitextractor shells out to the git CLI, so the binary must be present or
     # every clone fails with "git: executable file not found in $PATH".
-    # debian:bookworm-slim does not ship it; the official image inherits it from
+    # debian:trixie-slim does not ship it; the official image inherits it from
     # its python base.
     git \
     && rm -rf /var/lib/apt/lists/*

backend/python/DevelopmentSetup.md

@@ -22,9 +22,9 @@ limitations under the License.
 For the Python plugin tests to run properly, the following steps must be taken:
 
 1. The following packages are required for Ubuntu: `libffi-dev default-libmysqlclient-dev libpq-dev`
-2. `python3.11` is required by the time of this document.
-   - Try `deadsnakes` if you are using Ubuntu 22.04 or above, the `python3.11-dev` is required.
-   - Use `virtualenv` if you are having multiple python versions. `virtualenv -p python3.11 path/to/venv` and `source path/to/venv/bin/activate.sh` should do the trick
+2. `python3.14` is required by the time of this document.
+   - Try `deadsnakes` if you are using Ubuntu 22.04 or above, the `python3.14-dev` is required.
+   - Use `virtualenv` if you are having multiple python versions. `virtualenv -p python3.14 path/to/venv` and `source path/to/venv/bin/activate.sh` should do the trick
 3. both `mysql-client` and `postgresql` are required.
    - `postgresql` is required for `psycopg2` to work
 4. [poetry](https://python-poetry.org/) is required.

backend/python/plugins/azuredevops/pyproject.toml

@@ -21,7 +21,7 @@ authors = ["Hezheng Yin <hezheng@merico.dev>"]
 readme = "README.md"
 
 [tool.poetry.dependencies]
-python = ">=3.11,<3.12"
+python = ">=3.14,<3.15"
 pydevlake = { path = "../../pydevlake", develop = true }
 
 

backend/python/plugins/glpi/pyproject.toml

@@ -21,7 +21,7 @@ authors = ["Roger Abelenda <3179183+rabelenda@users.noreply.github.com>"]
 readme = "README.md"
 
 [tool.poetry.dependencies]
-python = ">=3.11,<3.12"
+python = ">=3.14,<3.15"
 pydevlake = { path = "../../pydevlake", develop = true }
 
 [tool.poetry.group.dev.dependencies]

backend/python/plugins/redmine/pyproject.toml

@@ -21,7 +21,7 @@ authors = ["Roger Abelenda <3179183+rabelenda@users.noreply.github.com>"]
 readme = "README.md"
 
 [tool.poetry.dependencies]
-python = ">=3.11,<3.12"
+python = ">=3.14,<3.15"
 pydevlake = { path = "../../pydevlake", develop = true }
 
 [tool.poetry.group.dev.dependencies]

backend/python/plugins/zephyr/pyproject.toml

@@ -21,7 +21,7 @@ authors = ["Roger Abelenda <3179183+rabelenda@users.noreply.github.com>"]
 readme = "README.md"
 
 [tool.poetry.dependencies]
-python = ">=3.11,<3.12"
+python = ">=3.14,<3.15"
 pydevlake = { path = "../../pydevlake", develop = true }
 
 [tool.poetry.group.dev.dependencies]

backend/python/pydevlake/pyproject.toml

@@ -22,7 +22,7 @@ license = "Apache-2.0"
 readme = "README.md"
 
 [tool.poetry.dependencies]
-python = ">=3.11,<3.12"
+python = ">=3.14,<3.15"
 sqlmodel = "^0.0.38"
 mysqlclient = "^2.1.1"
 requests = "^2.28.1"

backend/python/test/fakeplugin/pyproject.toml

@@ -20,7 +20,7 @@ description = "Fake python plugin used only in tests"
 authors = []
 
 [tool.poetry.dependencies]
-python = ">=3.11,<3.12"
+python = ">=3.14,<3.15"
 pydevlake = { path = "../../pydevlake", develop = true }
 
 

backend/python/uv.sh

@@ -50,7 +50,7 @@ sync_project() {
     rm -rf .venv
   fi
   if [ ! -x .venv/bin/python ]; then
-    uv venv --python "${DEVLAKE_PYTHON_VERSION:-3.11}" .venv
+    uv venv --python "${DEVLAKE_PYTHON_VERSION:-3.14}" .venv
   fi
   uv pip install --python .venv/bin/python -e .
 }

devops/docker/lake-builder/Dockerfile

@@ -18,7 +18,7 @@
 FROM ghcr.io/astral-sh/uv:0.13.7 AS uv
 
 # Same Python line as the runtime image in backend/Dockerfile.
-FROM python:3.11-slim-bookworm
+FROM python:3.14-slim-trixie
 
 RUN apt -y update && apt -y upgrade && apt -y install tzdata make tar curl gcc g++ pkg-config git \
     zlib1g libffi-dev  \