Skip to content

chore(deps): docker: bump the all-docker group across 1 directory with 2 updates #877

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
dependabot wants to merge 1 commit into from
Closed

chore(deps): docker: bump the all-docker group across 1 directory with 2 updates #877

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions agent/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,14 +19,14 @@ ARG GH_VERSION=2.93.0
#
# To bump: `docker buildx imagetools inspect <image>:<tag>` and copy the Digest.
# Keep the tag alongside the digest; it documents what the digest is meant to be.
FROM --platform=$TARGETPLATFORM jdxcode/mise:latest@sha256:df5adf538c92d86f9807e738c7c7a9b32a1ae06edf441ede141333e3fe6a2cd9 AS mise
FROM --platform=$TARGETPLATFORM jdxcode/mise:latest@sha256:d549958171c177f113e62ddba5afdfb9e245d699ac457148e4b7b0da7af3b0b7 AS mise

@scottschreckengaust scottschreckengaust Sep 14, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

mise digest bump (df5adf5 -> d549958) - routine and low-risk. Please confirm the new digest is the genuine multi-arch index for jdxcode/mise:latest (incl. linux/arm64) via docker buildx imagetools inspect, per this file's own bump note; I could not verify registry provenance from the review sandbox.


# Build gh with a patched Go toolchain; upstream packages can lag Go CVE fixes.
FROM --platform=$TARGETPLATFORM golang:1.27.1-bookworm@sha256:648f440f42a0958804efb24df176f806f9d353b41f1c0627f666428e40310f6b AS gh-builder
ARG GH_VERSION
RUN GOPROXY=direct GOBIN=/out go install "github.com/cli/cli/v2/cmd/gh@v${GH_VERSION}"

FROM --platform=$TARGETPLATFORM python:3.13-slim@sha256:dc1546eefcbe8caaa1f004f16ab76b204b5e1dbd58ff81b899f21cd40541232f
FROM --platform=$TARGETPLATFORM python:3.14-slim@sha256:cad9a2c871761c413caa6fdd6441c783451e740a48aaeba60ae62a8b53525ef6

@scottschreckengaust scottschreckengaust Sep 14, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Runtime interpreter feature-jump 3.13 -> 3.14. The container builds its venv via uv sync --frozen off this base image (no agent/mise.toml / .python-version is copied in), so the deployed agent will run on Python 3.14 while every quality gate still validates 3.13: agent/mise.toml:4 (python = "3.13"), ruff target-version = "py313" (pyproject.toml:97), ty python-version = "3.13" (pyproject.toml:184), and pyproject.toml:180 explicitly notes 3.14+ deprecation behavior. The PR build check runs on mise-pinned 3.13 and does not build this image, so 3.14 (incl. cp314 wheels for cedarpy==4.8.4 and other native pins) is unvalidated by CI. Recommend either bumping the 3.13 pins to 3.14 in the same PR so lint/type/tests match the shipped interpreter, or holding this line at 3.13-slim and merging only the mise digest bump.


# Install mise (polyglot dev tool manager)
COPY --from=mise /usr/local/bin/mise /usr/local/bin/mise
Expand Down
Loading