update a stable build as per python verison 3.14

2026-09-07 08:26:10 +00:00 · 2026-02-11 03:25:54 +00:00 · 2026-02-11 03:25:54 +00:00 · 5e81bf8bc6
commit 5e81bf8bc6
parent 226643eefe
5 changed files with 30 additions and 28 deletions
--- a/14
+++ b/14
@ -13,21 +13,22 @@ WORKDIR /app
 USER root

 # Install build dependencies
-RUN apk add --no-cache bash gcc git openssl openssl-dev
+RUN apk add --no-cache bash gcc git curl build-base openssl openssl-dev

 RUN python -m pip install --upgrade pip setuptools && \
    python -m pip install build wheel cmake setuptools_rust maturin

+# Install build dependencies needed for git-based packages
+RUN pip install --no-cache-dir hatchling hatch-vcs
+
 # Configure Rust environment for building Rust-backed Python wheels
 ENV CARGO_HOME=/root/.cargo
 ENV PATH=/root/.cargo/bin:$PATH
 # Allow forward-compatible ABI for PyO3-based packages on Python 3.14
 ENV PYO3_USE_ABI3_FORWARD_COMPATIBILITY=1

-RUN apk add --no-cache curl build-base openssl-dev && \
-    curl https://sh.rustup.rs -sSf | sh -s -- -y && \
-    rustup default stable && \
-    python -m pip install maturin
+RUN curl https://sh.rustup.rs -sSf | sh -s -- -y && \
+    rustup default stable

 # Copy the current directory contents into the container at /app
 COPY . .
@ -45,9 +46,6 @@ RUN ls -1 dist/*.whl | head -1
 # Install the package
 RUN pip install dist/*.whl

-# Install build dependencies needed for git-based packages
-RUN pip install --no-cache-dir hatchling hatch-vcs
-
 # Install dependencies as wheels, force binary for Pillow/tokenizers to avoid build issues
 RUN pip wheel --no-cache-dir --wheel-dir=/wheels/ --only-binary=Pillow,tokenizers -r requirements.txt
 # ensure pyjwt is used, not jwt
--- a/ci_cd/.grype.yaml
+++ b/ci_cd/.grype.yaml
@ -1,7 +1,7 @@
 ignore:
  - vulnerability: CVE-2026-22184
    reason: no fixed zlib package is available yet in the Wolfi repositories, so this is ignored temporarily until an upstream release exists
-  # Wolfi base image: Python 3.13 and Node from apk have no fixed builds in Wolfi yet / not applicable
+  # Chainguard base image: Node from apk has no fixed builds yet / not applicable
  - vulnerability: CVE-2025-55130
    reason: Node in Wolfi apk; only used for Admin UI build/prisma
  - vulnerability: CVE-2025-59465
@ -19,18 +19,18 @@ ignore:
  - vulnerability: GHSA-73rr-hh4g-fpgx
    reason: diff npm transitive dep; override in package.json, allowlisted
  - vulnerability: CVE-2026-0865
-    reason: Python 3.13 in Wolfi base; no fixed apk build yet
+    reason: Python in Chainguard base; no fixed apk build yet
  - vulnerability: CVE-2025-15282
-    reason: Python 3.13 in Wolfi base; no fixed apk build yet
+    reason: Python in Chainguard base; no fixed apk build yet
  - vulnerability: CVE-2026-0672
-    reason: Python 3.13 in Wolfi base; no fixed apk build yet
+    reason: Python in Chainguard base; no fixed apk build yet
  - vulnerability: CVE-2025-15366
-    reason: Python 3.13 in Wolfi base; no fixed apk build yet
+    reason: Python in Chainguard base; no fixed apk build yet
  - vulnerability: CVE-2025-15367
-    reason: Python 3.13 in Wolfi base; no fixed apk build yet
+    reason: Python in Chainguard base; no fixed apk build yet
  - vulnerability: CVE-2025-11468
-    reason: Python 3.13 in Wolfi base; no fixed apk build yet
+    reason: Python in Chainguard base; no fixed apk build yet
  - vulnerability: CVE-2025-12781
-    reason: Python 3.13 in Wolfi base; no fixed apk build yet
+    reason: Python in Chainguard base; no fixed apk build yet
  - vulnerability: CVE-2026-1299
-    reason: Python 3.13 in Wolfi base; no fixed apk build yet
+    reason: Python in Chainguard base; no fixed apk build yet
--- a/ci_cd/security_scans.sh
+++ b/ci_cd/security_scans.sh
@ -126,8 +126,8 @@ run_grype_scans() {
        "GHSA-4xh5-x5gv-qwph"
        "CVE-2025-8291" # no fix available as of Oct 11, 2025
        "GHSA-5j98-mcp5-4vw2"
-        "CVE-2025-13836" # Python 3.13 HTTP response reading OOM/DoS - no fix available in base image
-        "CVE-2025-12084" # Python 3.13 xml.dom.minidom quadratic algorithm - no fix available in base image
+        "CVE-2025-13836" # Python HTTP response reading OOM/DoS - no fix available in base image
+        "CVE-2025-12084" # Python xml.dom.minidom quadratic algorithm - no fix available in base image
        "CVE-2025-60876" # BusyBox wget HTTP request splitting - no fix available in Chainguard Wolfi base image
        "CVE-2026-0861" # Wolfi glibc still flagged even on 2.42-r5; upstream patched build unavailable yet
        "CVE-2010-4756" # glibc glob DoS - awaiting patched Wolfi glibc build
@ -156,7 +156,7 @@ run_grype_scans() {
        "CVE-2025-15367" # No fix available yet
        "CVE-2025-12781" # No fix available yet
        "CVE-2025-11468" # No fix available yet
-        "CVE-2026-1299" # Python 3.13 email module header injection - not applicable, LiteLLM doesn't use BytesGenerator for email serialization
+        "CVE-2026-1299" # Python email module header injection - not applicable, LiteLLM doesn't use BytesGenerator for email serialization
        "CVE-2026-0775" # npm cli incorrect permission assignment - no fix available yet, npm is only used at build/prisma-generate time
    )

--- a/docker/Dockerfile.non_root
+++ b/docker/Dockerfile.non_root
@ -2,12 +2,15 @@
 ARG LITELLM_BUILD_IMAGE=cgr.dev/chainguard/python:latest-dev
 ARG LITELLM_RUNTIME_IMAGE=cgr.dev/chainguard/python:latest-dev
 ARG PROXY_EXTRAS_SOURCE=published
+# Python version shipped in the Chainguard base image (update when base image changes)
+ARG PYTHON_VERSION=3.14

 # -----------------
 # Builder Stage
 # -----------------
 FROM $LITELLM_BUILD_IMAGE AS builder
 ARG PROXY_EXTRAS_SOURCE
+ARG PYTHON_VERSION
 WORKDIR /app
 USER root

@ -89,7 +92,7 @@ RUN if [ "$PROXY_EXTRAS_SOURCE" = "local" ]; then \
 ENV PRISMA_BINARY_CACHE_DIR=/app/.cache/prisma-python/binaries \
    PRISMA_CLI_BINARY_TARGETS="debian-openssl-3.0.x" \
    XDG_CACHE_HOME=/app/.cache \
-    PATH="/usr/lib/python3.14/site-packages/nodejs/bin:${PATH}"
+    PATH="/usr/lib/python${PYTHON_VERSION}/site-packages/nodejs/bin:${PATH}"

 RUN pip install --no-cache-dir prisma==0.11.0 nodejs-wheel-binaries==24.12.0 \
    && mkdir -p /app/.cache/npm
@ -106,6 +109,7 @@ RUN prisma generate && \
 # -----------------
 FROM $LITELLM_RUNTIME_IMAGE AS runtime
 ARG PROXY_EXTRAS_SOURCE
+ARG PYTHON_VERSION
 WORKDIR /app
 USER root

@ -142,11 +146,11 @@ COPY --from=builder /var/lib/litellm/assets /var/lib/litellm/assets
 COPY --from=builder /app/.cache /app/.cache
 COPY --from=builder /app/litellm-proxy-extras /app/litellm-proxy-extras
 COPY --from=builder \
-  /usr/lib/python3.14/site-packages/nodejs* \
-  /usr/lib/python3.14/site-packages/prisma* \
-  /usr/lib/python3.14/site-packages/tomlkit* \
-  /usr/lib/python3.14/site-packages/nodeenv* \
-  /usr/lib/python3.14/site-packages/
+  /usr/lib/python${PYTHON_VERSION}/site-packages/nodejs* \
+  /usr/lib/python${PYTHON_VERSION}/site-packages/prisma* \
+  /usr/lib/python${PYTHON_VERSION}/site-packages/tomlkit* \
+  /usr/lib/python${PYTHON_VERSION}/site-packages/nodeenv* \
+  /usr/lib/python${PYTHON_VERSION}/site-packages/
 COPY --from=builder /usr/bin/prisma /usr/bin/prisma

 # Final runtime environment configuration
--- a/docker/tests/nonroot.yaml
+++ b/docker/tests/nonroot.yaml
@ -7,12 +7,12 @@ metadataTest:

 fileExistenceTests:
  - name: "Prisma Folder"
-    path: "/usr/local/lib/python3.13/site-packages/prisma/"
+    path: "/usr/lib/python3.14/site-packages/prisma/"
    shouldExist: true
    uid: 65534
    gid: 65534
  - name: "Prisma Schema"
-    path: "/usr/local/lib/python3.13/site-packages/prisma/schema.prisma"
+    path: "/usr/lib/python3.14/site-packages/prisma/schema.prisma"
    shouldExist: true
    uid: 65534
    gid: 65534