From 191fe8c9496b5f09d797da3c45bd2620cad4ad98 Mon Sep 17 00:00:00 2001 From: coding-dev-tools Date: Wed, 4 Nov 2026 00:06:59 -0500 Subject: [PATCH] fix(docker): update Python base image to 3.11.18 CVE-2026-115557 in the Python 3.11.17 runtime is fixed in 3.11.18. Pin the new multi-arch digest so the release grype gate can pass. Co-authored-by: CommandCodeBot --- Dockerfile | 2 +- tests/test_release_infrastructure.py | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/Dockerfile b/Dockerfile index 0b5e611e4..6f7796894 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,5 +1,5 @@ # Engraphis — self-hosted AI memory engine. Local-first; you bring the LLM. -FROM python:3.11-slim@sha256:b7a9e5f6a93d6d4a31f129bbd4bdee69efccb6ded0fb230d78aafaf37af98377 AS base +FROM python:3.11.18-slim@sha256:db20d8506e2f15b6db39b40b6015ca46bae855dec6dd326d462cfe79ae972893 AS base # ENGRAPHIS_HOST is deliberately NOT set here: docker-entrypoint.sh chooses IPv6 for a # Railway deployment (which injects RAILWAY_SERVICE_NAME) and 0.0.0.0 for ordinary Docker. diff --git a/tests/test_release_infrastructure.py b/tests/test_release_infrastructure.py index eaa815c93..dda9f52f3 100644 --- a/tests/test_release_infrastructure.py +++ b/tests/test_release_infrastructure.py @@ -215,8 +215,8 @@ def test_ci_and_release_audit_production_image_dependencies(): assert "tesseract-ocr" in _text("Dockerfile") assert ( _text("Dockerfile").splitlines()[1] - == "FROM python:3.11-slim@sha256:" - "b7a9e5f6a93d6d4a31f129bbd4bdee69efccb6ded0fb230d78aafaf37af98377 AS base" + == "FROM python:3.11.18-slim@sha256:" + "db20d8506e2f15b6db39b40b6015ca46bae855dec6dd326d462cfe79ae972893 AS base" ) assert "Verify production image OCR runtime" in ci assert "Verify production image OCR runtime" in release