From 8e8e70a36f787a67cdcc4c8d9e0fe38db26c83a8 Mon Sep 17 00:00:00 2001 From: Nigel Sheridan-Smith Date: Mon, 1 Jun 2026 15:27:26 +1000 Subject: [PATCH 1/2] build: upgrade base images to Debian trixie and Poetry 2.4.1 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Node base: node:24-bookworm → node:24-trixie - Python base: python:3.13-slim-bookworm → python:3.13-slim-trixie - Add trixie-security, trixie-updates, and trixie-proposed-updates repos - Apply targeted security upgrades before installing packages - MSSQL packages repo: debian/12 → debian/13 - POETRY_VERSION: 2.1.4 → 2.4.1 - Upgrade pip/setuptools/wheel before Poetry install Co-authored-by: Cursor --- Dockerfile | 29 +++++++++++++++++++++++------ 1 file changed, 23 insertions(+), 6 deletions(-) diff --git a/Dockerfile b/Dockerfile index 780d919786..917f191bbb 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,4 +1,4 @@ -FROM node:24-bookworm AS frontend-builder +FROM node:24-trixie AS frontend-builder RUN npm install --global pnpm@10.30.3 @@ -39,14 +39,29 @@ RUN --mount=type=cache,id=pnpm-store,target=/frontend/.cache/pnpm,uid=1001,gid=1 fi EOF -FROM python:3.13-slim-bookworm +FROM python:3.13-slim-trixie EXPOSE 5000 RUN useradd --create-home redash -# Ubuntu packages +# Add Debian trixie-security and trixie-updates repositories so we get the latest +# security fixes and stable point updates at build time. +# trixie-proposed-updates is kept for opt-in pre-release fixes already in flight. +RUN set -eux; \ + printf 'deb http://deb.debian.org/debian-security trixie-security main\n' \ + > /etc/apt/sources.list.d/trixie-security.list; \ + printf 'deb http://deb.debian.org/debian trixie-updates main\n' \ + > /etc/apt/sources.list.d/trixie-updates.list; \ + printf 'deb http://deb.debian.org/debian trixie-proposed-updates main\n' \ + > /etc/apt/sources.list.d/trixie-proposed-updates.list + +# Apply security archive first (forces -t trixie-security so the security pocket wins), +# then a general upgrade for stable point updates, then install build dependencies. RUN apt-get update && \ + DEBIAN_FRONTEND=noninteractive apt-get -y -t trixie-security upgrade && \ + DEBIAN_FRONTEND=noninteractive apt-get -y -t trixie-updates upgrade && \ + DEBIAN_FRONTEND=noninteractive apt-get -y upgrade && \ apt-get install -y --no-install-recommends \ pkg-config \ curl \ @@ -80,7 +95,7 @@ ARG databricks_odbc_driver_url=https://databricks-bi-artifacts.s3.us-east-2.amaz RUN < /etc/apt/sources.list.d/mssql-release.list + curl https://packages.microsoft.com/config/debian/13/prod.list > /etc/apt/sources.list.d/mssql-release.list apt-get update ACCEPT_EULA=Y apt-get install -y --no-install-recommends msodbcsql18 apt-get clean @@ -97,10 +112,12 @@ EOF WORKDIR /app -ENV POETRY_VERSION=2.1.4 +ENV POETRY_VERSION=2.4.1 ENV POETRY_HOME=/etc/poetry ENV POETRY_VIRTUALENVS_CREATE=false -RUN curl -sSL --retry 3 --retry-delay 5 https://install.python-poetry.org | python3 - + +RUN python3 -m pip install --no-cache-dir --upgrade "pip>=26.1" "setuptools>=78.1.1" "wheel>=0.46.2" \ + && curl -sSL --retry 3 --retry-delay 5 https://install.python-poetry.org | python3 - # Avoid crashes, including corrupted cache artifacts, when building multi-platform images with GitHub Actions. RUN /etc/poetry/bin/poetry cache clear pypi --all From 91510b72e5ba19aa350230d9007e913874cc5825 Mon Sep 17 00:00:00 2001 From: Nigel Sheridan-Smith Date: Mon, 1 Jun 2026 16:58:27 +1000 Subject: [PATCH 2/2] Add core-js --- package.json | 1 + pnpm-lock.yaml | 3 +++ 2 files changed, 4 insertions(+) diff --git a/package.json b/package.json index 810287b952..8267d847dc 100644 --- a/package.json +++ b/package.json @@ -105,6 +105,7 @@ "babel-plugin-istanbul": "^6.1.1", "babel-plugin-transform-builtin-extend": "^1.1.2", "copy-webpack-plugin": "^13.0.1", + "core-js": "^2.6.12", "css-loader": "^7.1.4", "cypress": "^11.2.0", "dayjs": "^1.11.9", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 55b8abcfc1..306edbef1f 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -197,6 +197,9 @@ importers: copy-webpack-plugin: specifier: ^13.0.1 version: 13.0.1(webpack@5.105.3) + core-js: + specifier: ^2.6.12 + version: 2.6.12 css-loader: specifier: ^7.1.4 version: 7.1.4(webpack@5.105.3)