updating versions to address vulnerabilities

circleci/images/citusupgradetester/Dockerfile

@@ -1,5 +1,4 @@
-# we cannot easily upgrade to python 3.11 as our mitmproxy fork does not ship with it
-FROM python:3.9.7-slim-bullseye AS base
+FROM python:3.12-slim-bookworm AS base
 
 # add unpriviliged user for tests
 RUN useradd -ms /bin/bash circleci
@@ -56,8 +55,8 @@ set -eux
 
 # install key and repositories
 curl -sf https://www.postgresql.org/media/keys/ACCC4CF8.asc | APT_KEY_DONT_WARN_ON_DANGEROUS_USAGE=1 apt-key add -
-echo "deb https://apt.postgresql.org/pub/repos/apt bullseye-pgdg main" >> /etc/apt/sources.list.d/postgresql.list
-echo "deb https://apt-archive.postgresql.org/pub/repos/apt bullseye-pgdg-archive main" >> /etc/apt/sources.list.d/postgresql.list
+echo "deb https://apt.postgresql.org/pub/repos/apt bookworm-pgdg main" >> /etc/apt/sources.list.d/postgresql.list
+echo "deb https://apt-archive.postgresql.org/pub/repos/apt bookworm-pgdg-archive main" >> /etc/apt/sources.list.d/postgresql.list
 
 apt-get update
 

circleci/images/citusupgradetester/files/etc/requirements.txt

@@ -1,57 +1,65 @@
-# generated from Citus's Pipfile.lock (in src/test/regress) as of #7491
+# generated from Citus's Pipfile.lock (in src/test/regress) as of #8422
 # using `pipenv requirements > requirements.txt`, so as to avoid the
 # need for pipenv/pyenv in this image
 
 -i https://pypi.python.org/simple
-asgiref==3.4.1; python_version >= '3.6'
-blinker==1.4
-brotli==1.0.9
-certifi==2024.2.2; python_version >= '3.6'
-cffi==1.16.0; platform_python_implementation != 'PyPy'
-click==8.0.4; python_version >= '3.6'
-construct==2.9.45
-cryptography==42.0.3; python_version >= '3.7'
+aioquic==1.2.0; python_version >= '3.8'
+argon2-cffi==25.1.0; python_version >= '3.8'
+argon2-cffi-bindings==25.1.0; python_version >= '3.9'
+asgiref==3.10.0; python_version >= '3.9'
+attrs==25.4.0; python_version >= '3.9'
+bcrypt==5.0.0; python_version >= '3.8'
+blinker==1.9.0; python_version >= '3.9'
+brotli==1.2.0
+certifi==2025.11.12; python_version >= '3.7'
+cffi==2.0.0; python_version >= '3.9'
+click==8.3.1; python_version >= '3.10'
+construct==2.10.70; python_version >= '3.6'
+cryptography==44.0.3; python_version >= '3.7' and python_full_version not in '3.9.0, 3.9.1'
 docopt==0.6.2
-exceptiongroup==1.2.0; python_version < '3.11'
-execnet==2.0.2; python_version >= '3.7'
-filelock==3.13.1; python_version >= '3.8'
-flask==2.0.3; python_version >= '3.6'
-h11==0.12.0; python_version >= '3.6'
-h2==4.1.0; python_full_version >= '3.6.1'
-hpack==4.0.0; python_full_version >= '3.6.1'
-hyperframe==6.0.1; python_full_version >= '3.6.1'
-iniconfig==2.0.0; python_version >= '3.7'
-itsdangerous==2.1.2; python_version >= '3.7'
-jinja2==3.1.3; python_version >= '3.7'
-kaitaistruct==0.9
+execnet==2.1.2; python_version >= '3.8'
+filelock==3.20.1; python_version >= '3.10'
+flask==3.1.2; python_version >= '3.9'
+h11==0.16.0; python_version >= '3.8'
+h2==4.3.0; python_version >= '3.9'
+hpack==4.1.0; python_version >= '3.9'
+hyperframe==6.1.0; python_version >= '3.9'
+iniconfig==2.3.0; python_version >= '3.10'
+itsdangerous==2.2.0; python_version >= '3.8'
+jinja2==3.1.6; python_version >= '3.7'
+kaitaistruct==0.11; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3'
 ldap3==2.9.1
-markupsafe==2.1.5; python_version >= '3.7'
--e git+https://github.com/citusdata/mitmproxy.git@2fd18ef051b987925a36337ab1d61aa674353b44#egg=mitmproxy
-msgpack==1.0.7; python_version >= '3.8'
-packaging==23.2; python_version >= '3.7'
-passlib==1.7.4
-pluggy==1.4.0; python_version >= '3.8'
-protobuf==3.18.3; python_version >= '3.5'
-psycopg==3.1.18; python_version >= '3.7'
+markupsafe==3.0.3; python_version >= '3.9'
+mitmproxy @ git+https://github.com/citusdata/mitmproxy.git@66594bb8af146cce8d9bd7f79f46b77785f3d699
+mitmproxy-linux==0.12.8; python_version >= '3.12'
+mitmproxy-rs==0.12.8; python_version >= '3.12'
+msgpack==1.1.2; python_version >= '3.9'
+packaging==25.0; python_version >= '3.8'
+pluggy==1.6.0; python_version >= '3.9'
+psycopg==3.3.2; python_version >= '3.10'
 publicsuffix2==2.20191221
-pyasn1==0.5.1; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'
-pycparser==2.21
-pyopenssl==24.0.0; python_version >= '3.7'
-pyparsing==2.4.7; python_version >= '2.6' and python_version not in '3.0, 3.1, 3.2, 3.3'
-pyperclip==1.8.2
-pytest==8.0.0; python_version >= '3.8'
-pytest-asyncio==0.23.5; python_version >= '3.8'
-pytest-repeat==0.9.3; python_version >= '3.7'
-pytest-timeout==2.2.0; python_version >= '3.7'
-pytest-xdist==3.5.0; python_version >= '3.7'
-pyyaml==6.0.1; python_version >= '3.6'
-ruamel.yaml==0.17.16; python_version >= '3'
-ruamel.yaml.clib==0.2.8; python_version < '3.10' and platform_python_implementation == 'CPython'
+pyasn1==0.6.1; python_version >= '3.8'
+pyasn1-modules==0.4.2; python_version >= '3.8'
+pycparser==2.23; python_version >= '3.8'
+pygments==2.19.2; python_version >= '3.8'
+pylsqpack==0.3.23; python_version >= '3.10'
+pyopenssl==25.1.0; python_version >= '3.7'
+pyparsing==3.2.5; python_version >= '3.9'
+pyperclip==1.9.0
+pytest==9.0.2; python_version >= '3.10'
+pytest-asyncio==1.3.0; python_version >= '3.10'
+pytest-repeat==0.9.4; python_version >= '3.9'
+pytest-timeout==2.4.0; python_version >= '3.7'
+pytest-xdist==3.8.0; python_version >= '3.9'
+pyyaml==6.0.3; python_version >= '3.8'
+ruamel.yaml==0.18.16; python_version >= '3.8'
+ruamel.yaml.clib==0.2.15; python_version >= '3.9'
+service-identity==24.2.0; python_version >= '3.8'
 sortedcontainers==2.4.0
-tomli==2.0.1; python_version < '3.11'
-tornado==6.4; python_version >= '3.8'
-typing-extensions==4.9.0; python_version >= '3.8'
-urwid==2.1.2
-werkzeug==2.3.7; python_version >= '3.8'
-wsproto==1.0.0; python_full_version >= '3.6.1'
-zstandard==0.15.2; python_version >= '3.5'
+tornado==6.5.2; python_version >= '3.9'
+typing-extensions==4.14.0; python_version >= '3.9'
+urwid==3.0.3; python_full_version >= '3.9.0'
+wcwidth==0.2.14; python_version >= '3.6'
+werkzeug==3.1.0; python_version >= '3.9'
+wsproto==1.2.0; python_full_version >= '3.7.0'
+zstandard==0.25.0; python_version >= '3.9'

circleci/images/extbuilder/Dockerfile

@@ -1,4 +1,4 @@
-FROM buildpack-deps:bullseye
+FROM buildpack-deps:bookworm
 
 # add unpriviliged user for tests
 RUN useradd -ms /bin/bash circleci
@@ -48,8 +48,8 @@ set -eux
 
 # install key and repositories
 curl -sf https://www.postgresql.org/media/keys/ACCC4CF8.asc | APT_KEY_DONT_WARN_ON_DANGEROUS_USAGE=1 apt-key add -
-echo "deb https://apt.postgresql.org/pub/repos/apt bullseye-pgdg main" >> /etc/apt/sources.list.d/postgresql.list
-echo "deb https://apt-archive.postgresql.org/pub/repos/apt bullseye-pgdg-archive main" >> /etc/apt/sources.list.d/postgresql.list
+echo "deb https://apt.postgresql.org/pub/repos/apt bookworm-pgdg main" >> /etc/apt/sources.list.d/postgresql.list
+echo "deb https://apt-archive.postgresql.org/pub/repos/apt bookworm-pgdg-archive main" >> /etc/apt/sources.list.d/postgresql.list
 
 apt-get update
 

circleci/images/exttester/Dockerfile

@@ -1,6 +1,6 @@
 # postgres doesn't ship their isolation tester in the server-dev images
 # we use this builder to build the isolation tester from a specific version
-FROM buildpack-deps:bullseye AS dev-tools-builder
+FROM buildpack-deps:bookworm AS dev-tools-builder
 
 RUN <<'EOF'
 # install dependencies
@@ -65,7 +65,7 @@ WORKDIR /build/postgresql-${PG_VERSION_CLEAN}/build
 RUN ../configure --prefix /usr/lib/postgresql/${PG_MAJOR}/
 RUN make -sj8
 
-FROM buildpack-deps:bullseye AS dev-tools-collection
+FROM buildpack-deps:bookworm AS dev-tools-collection
 
 WORKDIR /collect
 
@@ -84,7 +84,7 @@ COPY --from=dev-tools-builder /build/postgresql-${PG_VERSION_CLEAN}/build/src/te
 COPY --from=dev-tools-builder /build/postgresql-${PG_VERSION_CLEAN}/src/test/regress/ usr/lib/postgresql/${PG_MAJOR}/lib/regress/
 RUN rm -rf usr/lib/postgresql/${PG_MAJOR}/lib/regress/*.c usr/lib/postgresql/${PG_MAJOR}/lib/regress/*.h
 
-FROM buildpack-deps:bullseye AS setup-environment
+FROM buildpack-deps:bookworm AS setup-environment
 
 # add unpriviliged user for tests
 RUN useradd -ms /bin/bash circleci
@@ -153,8 +153,8 @@ set -eux
 
 # install key and repositories
 curl -sf https://www.postgresql.org/media/keys/ACCC4CF8.asc | APT_KEY_DONT_WARN_ON_DANGEROUS_USAGE=1 apt-key add -
-echo "deb https://apt.postgresql.org/pub/repos/apt bullseye-pgdg main" >> /etc/apt/sources.list.d/postgresql.list
-echo "deb https://apt-archive.postgresql.org/pub/repos/apt bullseye-pgdg-archive main" >> /etc/apt/sources.list.d/postgresql.list
+echo "deb https://apt.postgresql.org/pub/repos/apt bookworm-pgdg main" >> /etc/apt/sources.list.d/postgresql.list
+echo "deb https://apt-archive.postgresql.org/pub/repos/apt bookworm-pgdg-archive main" >> /etc/apt/sources.list.d/postgresql.list
 
 apt-get update
 
@@ -163,16 +163,17 @@ pgdg_version=$(apt list -a postgresql-server-dev-${PG_MAJOR} 2>/dev/null | grep
 
 apt-get install -y --no-install-recommends --allow-downgrades \
     libdbi-perl \
-    libdbd-pg-perl=3.16.3-1.pgdg110+1 \
     libpq-dev=${pgdg_version} \
     libpq5=${pgdg_version} \
     postgresql-${PG_MAJOR}=${pgdg_version} \
     postgresql-client-${PG_MAJOR}=${pgdg_version} \
     postgresql-${PG_MAJOR}-dbgsym=${pgdg_version} \
     postgresql-server-dev-${PG_MAJOR}=${pgdg_version} \
-    postgresql-${PG_MAJOR}-wal2json \
+    postgresql-${PG_MAJOR}-wal2json
 
-    # clear apt cache
+apt-get install -y --no-install-recommends -t bookworm libdbd-pg-perl
+
+# clear apt cache
 rm -rf /var/lib/apt/lists/*
 EOF
 

circleci/images/failtester/Dockerfile

@@ -1,5 +1,4 @@
-# we cannot easily upgrade to python 3.11 as our mitmproxy fork does not ship with it
-FROM python:3.9.7-slim-bullseye
+FROM python:3.12-slim-bookworm
 
 # add unpriviliged user for tests
 RUN useradd -ms /bin/bash circleci
@@ -55,8 +54,8 @@ RUN <<'EOF'
 
 # install key and repositories
 curl -sf https://www.postgresql.org/media/keys/ACCC4CF8.asc | APT_KEY_DONT_WARN_ON_DANGEROUS_USAGE=1 apt-key add -
-echo "deb https://apt.postgresql.org/pub/repos/apt bullseye-pgdg main" >> /etc/apt/sources.list.d/postgresql.list
-echo "deb https://apt-archive.postgresql.org/pub/repos/apt bullseye-pgdg-archive main" >> /etc/apt/sources.list.d/postgresql.list
+echo "deb https://apt.postgresql.org/pub/repos/apt bookworm-pgdg main" >> /etc/apt/sources.list.d/postgresql.list
+echo "deb https://apt-archive.postgresql.org/pub/repos/apt bookworm-pgdg-archive main" >> /etc/apt/sources.list.d/postgresql.list
 
 apt-get update
 
@@ -82,6 +81,23 @@ ENV PATH=/usr/lib/postgresql/$PG_MAJOR/bin/:$PATH
 RUN mkdir -p /var/run/postgresql && chown -R postgres:postgres /var/run/postgresql && chmod 2777 /var/run/postgresql
 
 COPY ./files/etc/requirements.txt /tmp/etc/
-RUN pip3 install -Ir /tmp/etc/requirements.txt
+RUN <<EOF
+set -eux
+
+pip3 install -Ir /tmp/etc/requirements.txt
+
+MITMDUMP_BIN="$(python3 -c 'import sysconfig, pathlib; print(pathlib.Path(sysconfig.get_path("scripts")) / "mitmdump")')"
+
+if [ ! -x "$MITMDUMP_BIN" ]; then
+    echo "mitmdump executable not found at $MITMDUMP_BIN" >&2
+    exit 1
+fi
+
+if [ "$MITMDUMP_BIN" != "/usr/local/bin/mitmdump" ]; then
+    ln -sf "$MITMDUMP_BIN" /usr/local/bin/mitmdump
+fi
+
+hash mitmdump
+EOF
 
 WORKDIR /home/circleci

circleci/images/failtester/files/etc/requirements.txt

@@ -1,57 +1,65 @@
-# generated from Citus's Pipfile.lock (in src/test/regress) as of #7491
+# generated from Citus's Pipfile.lock (in src/test/regress) as of #8422
 # using `pipenv requirements > requirements.txt`, so as to avoid the
 # need for pipenv/pyenv in this image
 
 -i https://pypi.python.org/simple
-asgiref==3.4.1; python_version >= '3.6'
-blinker==1.4
-brotli==1.0.9
-certifi==2024.2.2; python_version >= '3.6'
-cffi==1.16.0; platform_python_implementation != 'PyPy'
-click==8.0.4; python_version >= '3.6'
-construct==2.9.45
-cryptography==42.0.3; python_version >= '3.7'
+aioquic==1.2.0; python_version >= '3.8'
+argon2-cffi==25.1.0; python_version >= '3.8'
+argon2-cffi-bindings==25.1.0; python_version >= '3.9'
+asgiref==3.10.0; python_version >= '3.9'
+attrs==25.4.0; python_version >= '3.9'
+bcrypt==5.0.0; python_version >= '3.8'
+blinker==1.9.0; python_version >= '3.9'
+brotli==1.2.0
+certifi==2025.11.12; python_version >= '3.7'
+cffi==2.0.0; python_version >= '3.9'
+click==8.3.1; python_version >= '3.10'
+construct==2.10.70; python_version >= '3.6'
+cryptography==44.0.3; python_version >= '3.7' and python_full_version not in '3.9.0, 3.9.1'
 docopt==0.6.2
-exceptiongroup==1.2.0; python_version < '3.11'
-execnet==2.0.2; python_version >= '3.7'
-filelock==3.13.1; python_version >= '3.8'
-flask==2.0.3; python_version >= '3.6'
-h11==0.12.0; python_version >= '3.6'
-h2==4.1.0; python_full_version >= '3.6.1'
-hpack==4.0.0; python_full_version >= '3.6.1'
-hyperframe==6.0.1; python_full_version >= '3.6.1'
-iniconfig==2.0.0; python_version >= '3.7'
-itsdangerous==2.1.2; python_version >= '3.7'
-jinja2==3.1.3; python_version >= '3.7'
-kaitaistruct==0.9
+execnet==2.1.2; python_version >= '3.8'
+filelock==3.20.1; python_version >= '3.10'
+flask==3.1.2; python_version >= '3.9'
+h11==0.16.0; python_version >= '3.8'
+h2==4.3.0; python_version >= '3.9'
+hpack==4.1.0; python_version >= '3.9'
+hyperframe==6.1.0; python_version >= '3.9'
+iniconfig==2.3.0; python_version >= '3.10'
+itsdangerous==2.2.0; python_version >= '3.8'
+jinja2==3.1.6; python_version >= '3.7'
+kaitaistruct==0.11; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3'
 ldap3==2.9.1
-markupsafe==2.1.5; python_version >= '3.7'
--e git+https://github.com/citusdata/mitmproxy.git@2fd18ef051b987925a36337ab1d61aa674353b44#egg=mitmproxy
-msgpack==1.0.7; python_version >= '3.8'
-packaging==23.2; python_version >= '3.7'
-passlib==1.7.4
-pluggy==1.4.0; python_version >= '3.8'
-protobuf==3.18.3; python_version >= '3.5'
-psycopg==3.1.18; python_version >= '3.7'
+markupsafe==3.0.3; python_version >= '3.9'
+mitmproxy @ git+https://github.com/citusdata/mitmproxy.git@66594bb8af146cce8d9bd7f79f46b77785f3d699
+mitmproxy-linux==0.12.8; python_version >= '3.12'
+mitmproxy-rs==0.12.8; python_version >= '3.12'
+msgpack==1.1.2; python_version >= '3.9'
+packaging==25.0; python_version >= '3.8'
+pluggy==1.6.0; python_version >= '3.9'
+psycopg==3.3.2; python_version >= '3.10'
 publicsuffix2==2.20191221
-pyasn1==0.5.1; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'
-pycparser==2.21
-pyopenssl==24.0.0; python_version >= '3.7'
-pyparsing==2.4.7; python_version >= '2.6' and python_version not in '3.0, 3.1, 3.2, 3.3'
-pyperclip==1.8.2
-pytest==8.0.0; python_version >= '3.8'
-pytest-asyncio==0.23.5; python_version >= '3.8'
-pytest-repeat==0.9.3; python_version >= '3.7'
-pytest-timeout==2.2.0; python_version >= '3.7'
-pytest-xdist==3.5.0; python_version >= '3.7'
-pyyaml==6.0.1; python_version >= '3.6'
-ruamel.yaml==0.17.16; python_version >= '3'
-ruamel.yaml.clib==0.2.8; python_version < '3.10' and platform_python_implementation == 'CPython'
+pyasn1==0.6.1; python_version >= '3.8'
+pyasn1-modules==0.4.2; python_version >= '3.8'
+pycparser==2.23; python_version >= '3.8'
+pygments==2.19.2; python_version >= '3.8'
+pylsqpack==0.3.23; python_version >= '3.10'
+pyopenssl==25.1.0; python_version >= '3.7'
+pyparsing==3.2.5; python_version >= '3.9'
+pyperclip==1.9.0
+pytest==9.0.2; python_version >= '3.10'
+pytest-asyncio==1.3.0; python_version >= '3.10'
+pytest-repeat==0.9.4; python_version >= '3.9'
+pytest-timeout==2.4.0; python_version >= '3.7'
+pytest-xdist==3.8.0; python_version >= '3.9'
+pyyaml==6.0.3; python_version >= '3.8'
+ruamel.yaml==0.18.16; python_version >= '3.8'
+ruamel.yaml.clib==0.2.15; python_version >= '3.9'
+service-identity==24.2.0; python_version >= '3.8'
 sortedcontainers==2.4.0
-tomli==2.0.1; python_version < '3.11'
-tornado==6.4; python_version >= '3.8'
-typing-extensions==4.9.0; python_version >= '3.8'
-urwid==2.1.2
-werkzeug==2.3.7; python_version >= '3.8'
-wsproto==1.0.0; python_full_version >= '3.6.1'
-zstandard==0.15.2; python_version >= '3.5'
+tornado==6.5.2; python_version >= '3.9'
+typing-extensions==4.14.0; python_version >= '3.9'
+urwid==3.0.3; python_full_version >= '3.9.0'
+wcwidth==0.2.14; python_version >= '3.6'
+werkzeug==3.1.0; python_version >= '3.9'
+wsproto==1.2.0; python_full_version >= '3.7.0'
+zstandard==0.25.0; python_version >= '3.9'

circleci/images/pgupgradetester/Dockerfile

@@ -1,5 +1,4 @@
-# we cannot easily upgrade to python 3.11 as our mitmproxy fork does not ship with it
-FROM python:3.9.7-slim-bullseye
+FROM python:3.12-slim-bookworm
 
 # add unpriviliged user for tests
 RUN useradd -ms /bin/bash circleci
@@ -56,8 +55,8 @@ set -eux
 
 # install key and repositories
 curl -sf https://www.postgresql.org/media/keys/ACCC4CF8.asc | APT_KEY_DONT_WARN_ON_DANGEROUS_USAGE=1 apt-key add -
-echo "deb https://apt.postgresql.org/pub/repos/apt bullseye-pgdg main" >> /etc/apt/sources.list.d/postgresql.list
-echo "deb https://apt-archive.postgresql.org/pub/repos/apt bullseye-pgdg-archive main" >> /etc/apt/sources.list.d/postgresql.list
+echo "deb https://apt.postgresql.org/pub/repos/apt bookworm-pgdg main" >> /etc/apt/sources.list.d/postgresql.list
+echo "deb https://apt-archive.postgresql.org/pub/repos/apt bookworm-pgdg-archive main" >> /etc/apt/sources.list.d/postgresql.list
 
 apt-get update