[Backport 7.83.x] Bump embedded Python to 3.13.15 - #24866
[Backport 7.83.x] Bump embedded Python to 3.13.15#24866dd-octo-sts[bot] wants to merge 2 commits into
Conversation
![dd-agent-integrations-bot[bot]](https://github.githubassets.com/images/gravatars/gravatar-user-420.png){kind=avatar}
|
Warning This PR changes Agent dependencies. Do not merge it until the wheels are promoted. Dependency inputs changed, so the dependency resolution and wheel build workflow runs on this branch. It takes 1.5 to 3 hours and finishes by committing updated lockfiles. The wheels it builds then have to be promoted before the Agent can use them. Steps to take, in order:
Merging before promotion leaves the Agent unable to install the wheels these lockfiles pin. Pushing again to this branch invalidates the promotion, so if you push after step 4 you have to promote again. Head commit |
|
Backport evaluation: View Slack thread |
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 5bb8614870
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
|
|
||
| # Compile and install Python 3 | ||
| ENV PYTHON3_VERSION=3.13.14 | ||
| ENV PYTHON3_VERSION=3.13.15 |
There was a problem hiding this comment.
Changing this builder image input without the matching .deps updates leaves the repo's dependency pin stale: I checked .github/workflows/verify-deps-pin.yaml, which runs cd .builders && python inputs_hash.py verify-resolution on merge-queue and 7.*.* refs, and running python .builders/inputs_hash.py status .builders/targets.json now reports the resolution and every target as STALE against .deps/builder_inputs.toml. The original 3.13.15 bump also updated .deps/builder_inputs.toml, .deps/image_digests.json, and the .deps/resolved/*_3.13.txt lockfiles; without those generated outputs, this backport either cannot pass the merge-queue check or, if landed directly on the release branch, leaves the Agent pinned to wheels/images built from the old inputs.
Useful? React with 👍 / 👎.
Kyle-Neale
changed the title
Validation ReportAll 21 validations passed. Show details
|
2 participants
What does this PR do?
Backported commit:
eda03ecc79- Bump embedded Python to 3.13.15Original PR: #24828
Target branch:
7.83.xUpgrades the pinned CPython patch version from 3.13.14 to 3.13.15 across the build tooling (
ddev/src/ddev/repo/constants.py, the Linux/Windows builder Dockerfiles, and the macOSpbs.envPython Build Standalone pins), backported to the7.83.xrelease branch.Motivation
3.13.15 (released 2026-08-05) remediates several CVEs tracked in the agent-integrations VULN queue, all fixed by the embedded-Python patch bump. Backporting keeps the
7.83.xrelease branch on a patched interpreter rather than waiting for the next minor:_Stream.seekEOF DoSReview checklist (to be filled by reviewers)
qa/requiredif this PR needs QA validation, orqa/skip-qaif it does not. Exactly one of the two is required.backport/<branch-name>label to the PR and it will automatically open a backport PR once this one is merged