Skip to content

chore(deps): bump python from 3.11-slim to 3.14-slim in /docker in the minor-and-patch group #237

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
dependabot wants to merge 1 commit into from
Closed

chore(deps): bump python from 3.11-slim to 3.14-slim in /docker in the minor-and-patch group #237

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion docker/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,7 +32,7 @@ RUN npm run build
# ---------------------------------------------------------------------------
# Stage 2: Production runtime
# ---------------------------------------------------------------------------
FROM python:3.11-slim AS runtime
FROM python:3.14-slim AS runtime

@coderabbitai coderabbitai Bot May 28, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Description: Verify python:3.14-slim exists on Docker Hub

# Check if the image exists and can be pulled
docker pull python:3.14-slim --dry-run 2>&1 || docker manifest inspect python:3.14-slim 2>&1

# If docker commands aren't available in sandbox, fall back to Docker Hub API
curl -fsSL "https://hub.docker.com/v2/repositories/library/python/tags/3.14-slim" 2>&1 | jq -r '.name // "NOT FOUND"'

Repository: cliff-security/cliff

Length of output: 164

🌐 Web query:

Is Python 3.14 released and stable as of May 2026? What is the release date?

💡 Result:

Yes. Python 3.14 was released and is stable as of May 2026; the latest stable maintenance release in May 2026 is Python 3.14.5, released on 2026-05-10 [1][2]. Python 3.14’s initial stable (major) release date was 2025-10-07 [3].

Citations:

🌐 Web query:

Do fastapi uvicorn httpx pydantic semgrep support Python 3.14?

💡 Result:

Yes, FastAPI, Uvicorn, HTTPX, Pydantic, and Semgrep all support Python 3.14 as of May 2026. Python 3.14 was officially released on October 7, 2025 [1][2]. Below is the status of support for each tool: FastAPI: Full support for Python 3.14 was added in October 2025 [3]. Recent updates have also added support for free-threaded Python 3.14t (a version of Python 3.14 without the Global Interpreter Lock) [4][5][6]. Uvicorn: Support for Python 3.14 was officially added in version 0.38.0, released in October 2025 [7]. HTTPX: The library supports Python 3.14. It has included Python 3.14 in its testing matrix since late 2025 [8]. Pydantic: Pydantic v2 includes support for Python 3.14 [9]. Note that Pydantic v1 is not supported on Python 3.14 and above [10][11]. Users relying on legacy Pydantic v1 code must migrate to Pydantic v2 to use it on this Python version [10]. Semgrep: Semgrep supports Python 3.14. While earlier versions encountered issues due to dependency pinning, these were resolved, and recent releases (such as 1.140.0 and later) include CI testing and official support for the Python 3.14 environment [12][13][14].

Citations:

Downgrade concern for Python 3.14 base: python:3.14-slim exists and core dependencies support 3.14 (still run Docker build/tests).

  • docker/Dockerfile line 35 (python:3.14-slim) tag is present on Docker Hub.
  • Python 3.14 is released/stable as of May 2026, and FastAPI, Uvicorn, HTTPX, Pydantic (v2), and Semgrep support Python 3.14.
  • Remaining risk is project-specific pinned dependencies/lockfiles (and Pydantic v1 vs v2); run docker build + the existing smoke/health checks against the 3.14 image to ensure install and runtime behavior are OK.
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docker/Dockerfile` at line 35, Update the Docker base image to
python:3.14-slim in docker/Dockerfile (the FROM python:3.14-slim line) and then
run a full docker build followed by the project's smoke and health check tests
to validate install and runtime behavior; specifically verify all pinned
dependencies and lockfile installs complete, confirm compatibility of Pydantic
(v1 vs v2) and other core libs (FastAPI, Uvicorn, HTTPX, Semgrep), and if any
installation or runtime failures occur revert the FROM line to the previously
used Python tag or adjust dependency pins accordingly.


ARG CLIFF_VERSION
ARG CLIFF_REVISION
Expand Down
Loading