chore: Bump Python to 3.11.13 in python connector base image by dbgold17 · Pull Request #62909 · airbytehq/airbyte

David Gold (dbgold17) · 2025-07-10T20:49:57Z

What

Publishes a new Python Connector Base Image version using 3.11.13 to resolve security vulnerabilities

publishing the new image as docker.io/airbyte/python-connector-base:4.0.2 because I noticed we already have a 4.0.1 referenced by source-s3

resolves https://github.com/airbytehq/oncall/issues/8316

How

For now, we define the python connector base image in 2 places:

docker-images/Dockerfile.python-connector-base as a Dockerfile
airbyte-ci/connectors/base_images/base_images/python/bases.py as a dagger object within AirbyteCI

I've updated both to use Python 3.11.13 and tried to keep them in sync although I then proceeded to ignore the AirbyteCI process for building the base image.

I manually published a release candidate of the new python connector base image using the Docker Image Publishing manual dispatch workflow: link

I tested that this new version worked with a handful of python connectors locally - source-s3, source-github, source-google-ads, source-facebook-marketing, source-salesforce (in addition to the automated tests that run on this PR: link)

The process for testing python connectors against a new base image locally is:

make sure you have published a base image as an rc docker image to Dockerhub
navigate to a connector directory
modify the base imaged used by changing the reference in the connector's metadata file
run airbyte-cdk secrets fetch to make sure you have the connector's test config files locally
run airbyte-cdk image test to build a docker image for the connector on top of the specified base image and run a suite of FAST tests using it.

I then also manually tested some manifest-only connectors by creating a release candidate of the SDM base image (link to PR)

Once ready to release, publish a version of the image without a -rc.# suffix using the same manual dispatch GH workflow (link)

Other notes

To generate the local json file registry and changelog used by airbyte-ci, follow the instructions in this README. I was unable to succesfully use AirbyteCI to build and publish to dockerhub with any creds I could find.

Can this PR be safely reverted and rolled back?

YES 💚
NO ❌

…o 3.11.13 - Add PYTHON_3_11_13 definition to root_images.py - Update AirbytePythonConnectorBaseImage to use Python 3.11.13 - Fix poppler-utils package version compatibility (22.12.0-2+b1 -> 22.12.0-2+deb12u1) - Update Dockerfile.python-connector-base with new Python version and SHA256 - Update documentation template changelog entry - Update test expectations for new Python version This addresses a security vulnerability in Python 3.11.11. Co-Authored-By: David Gold <32782137+dbgold17@users.noreply.github.com>

The changelog section is for airbyte-ci base images tool versions, not Python connector base image versions. Reverting the accidental change to maintain historical accuracy. Co-Authored-By: David Gold <32782137+dbgold17@users.noreply.github.com>

- Integrate poetry run generate-release changes - Resolve conflict by accepting removal of incorrect ### 1.6.0 changelog section - The changelog section is for airbyte-ci base images tool versions, not Python connector versions Co-Authored-By: David Gold <32782137+dbgold17@users.noreply.github.com>

vercel · 2025-07-10T20:50:05Z

The latest updates on your projects. Learn more about Vercel for Git ↗︎

1 Skipped Deployment

Name	Status	Preview	Comments	Updated (UTC)
airbyte-docs	⬜️ Ignored (Inspect)	Visit Preview		Jul 11, 2025 7:27pm

github-actions · 2025-07-10T20:50:19Z

👋 Greetings, Contributor!

Here are some helpful tips and reminders for your convenience.

Helpful Resources

PR Slash Commands

Airbyte Maintainers (that's you!) can execute the following slash commands on your PR:

/format-fix - Fixes most formatting issues.
/bump-version - Bumps connector versions.
- You can specify a custom changelog by passing changelog. Example: /bump-version changelog="My cool update"
- Leaving the changelog arg blank will auto-populate the changelog from the PR title.
/run-cat-tests - Runs legacy CAT tests (Connector Acceptance Tests)
/build-connector-images - Builds and publishes a pre-release docker image for the modified connector(s).

📝 Edit this welcome message.

David Gold (dbgold17) · 2025-07-10T20:50:59Z

 ## CHANGELOG

-### 1.6.0
- Add a Python base image 4.0.0 with Python 3.11.11.


This was added by mistake for the last python base image release. I believe this changelog refers to versions of the airbyte ci base images tool

Brian Lai (brianjlai) · 2025-07-10T21:07:46Z


            container = container.with_exec(
-                ["sh", "-c", "apt-get update && apt-get install -y tesseract-ocr=5.3.0-2 poppler-utils=22.12.0-2+b1"]
+                ["sh", "-c", "apt-get update && apt-get install -y tesseract-ocr=5.3.0-2 poppler-utils=22.12.0-2+deb12u1"]


where does ths tag come from?

so a while ago I was working on reproducing the base image build process from AirbyteCI in a Dockerfile (docker-images/Dockerfile.python-connector-base) as part of patching a vulnerability. For some reason the poppler-utils version defined within airbyte-ci was not found for install when building the Dockerfile, so I used this version instead.
PR link: #60820

The version was never backported to the AirbyteCI base image build process though

Brian Lai (brianjlai)

for posterity after david and I synced briefly:

I was a bit confused or just generally unaware of the process of how a new version of the python-connector-base image gets published to Dockerhub so that it can be referenced where we build the source-declarative-manifest.

Sounds like the GH workflow is this:
https://github.com/airbytehq/airbyte/actions/workflows/docker-connector-image-publishing.yml

Looking things over, changes seem reasonable, but I don't have a ton of context into this part of our code. ✅

…nector-base-image-3.11.13' into dbgold17/python-connector-base-image-3.11.13

github-actions · 2025-07-11T18:45:42Z

`source-google-drive` Connector Test Results

1 tests 0 ✅ 7s ⏱️
1 suites 0 💤
1 files 0 ❌ 1 🔥

For more details on these errors, see this check.

Results for commit b896959.

devin-ai-integration Bot and others added 4 commits July 8, 2025 23:29

run poetry run generate-release

da98875

David Gold (dbgold17) had a problem deploying to ghcr.io/airbytehq/python-connector-base July 10, 2025 20:50 — with GitHub Actions Error

David Gold (dbgold17) commented Jul 10, 2025

View reviewed changes

David Gold (dbgold17) marked this pull request as ready for review July 10, 2025 20:52

David Gold (dbgold17) requested a review from a team as a code owner July 10, 2025 20:52

Merge branch 'master' into dbgold17/python-connector-base-image-3.11.13

cfac612

David Gold (dbgold17) temporarily deployed to ghcr.io/airbytehq/python-connector-base July 10, 2025 20:53 — with GitHub Actions Inactive

vercel Bot deployed to Preview July 10, 2025 20:56 View deployment

David Gold (dbgold17) temporarily deployed to ghcr.io/airbytehq July 10, 2025 20:57 — with GitHub Actions Inactive

Brian Lai (brianjlai) reviewed Jul 10, 2025

View reviewed changes

Brian Lai (brianjlai) approved these changes Jul 10, 2025

View reviewed changes

David Gold (dbgold17) temporarily deployed to hub.docker.com/r/airbyte July 11, 2025 00:55 — with GitHub Actions Inactive

David Gold (dbgold17) mentioned this pull request Jul 11, 2025

chore: Update source-declarative-manifest to use python-connector-base 4.0.2 airbytehq/airbyte-python-cdk#651

Merged

David Gold (dbgold17) changed the title ~~Bump Python to 3.11.13 in python connector base image~~ chore: Bump Python to 3.11.13 in python connector base image Jul 11, 2025

David Gold (dbgold17) temporarily deployed to hub.docker.com/r/airbyte July 11, 2025 03:04 — with GitHub Actions Inactive

David Gold (dbgold17) added 2 commits July 10, 2025 20:08

regenerate airbyte-ci changelog now that I'm finalizing the release

7947e52

Merge remote-tracking branch 'refs/remotes/origin/dbgold17/python-con…

eea55f9

…nector-base-image-3.11.13' into dbgold17/python-connector-base-image-3.11.13

David Gold (dbgold17) temporarily deployed to ghcr.io/airbytehq/python-connector-base July 11, 2025 03:10 — with GitHub Actions Inactive

vercel Bot deployed to Preview July 11, 2025 03:13 View deployment

David Gold (dbgold17) temporarily deployed to ghcr.io/airbytehq July 11, 2025 03:14 — with GitHub Actions Inactive

test google drive source with new base image

b896959

Octavia Squidington III (octavia-squidington-iii) added the connectors/source/google-drive label Jul 11, 2025

David Gold (dbgold17) temporarily deployed to ghcr.io/airbytehq/python-connector-base July 11, 2025 18:43 — with GitHub Actions Inactive

David Gold (dbgold17) temporarily deployed to ghcr.io/airbytehq July 11, 2025 18:48 — with GitHub Actions Inactive

revert base image change for testing

97449a3

David Gold (dbgold17) temporarily deployed to ghcr.io/airbytehq/python-connector-base July 11, 2025 19:27 — with GitHub Actions Inactive

David Gold (dbgold17) temporarily deployed to ghcr.io/airbytehq July 11, 2025 19:32 — with GitHub Actions Inactive

David Gold (dbgold17) merged commit 7188e2d into master Jul 11, 2025
36 checks passed

David Gold (dbgold17) deleted the dbgold17/python-connector-base-image-3.11.13 branch July 11, 2025 19:40

Brian Lai (brianjlai) mentioned this pull request Sep 8, 2025

feat(source-pinterest): Update CDK to v6 #65960

Merged

2 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore: Bump Python to 3.11.13 in python connector base image#62909

chore: Bump Python to 3.11.13 in python connector base image#62909
David Gold (dbgold17) merged 9 commits into
masterfrom
dbgold17/python-connector-base-image-3.11.13

David Gold (dbgold17) commented Jul 10, 2025 •

edited

Loading

Uh oh!

vercel Bot commented Jul 10, 2025 •

edited

Loading

Uh oh!

github-actions Bot commented Jul 10, 2025

Uh oh!

David Gold (dbgold17) Jul 10, 2025

Uh oh!

Brian Lai (brianjlai) Jul 10, 2025

Uh oh!

David Gold (dbgold17) Jul 10, 2025

Uh oh!

David Gold (dbgold17) Jul 10, 2025

Uh oh!

Brian Lai (brianjlai) left a comment

Uh oh!

github-actions Bot commented Jul 11, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

David Gold (dbgold17) commented Jul 10, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What

How

Other notes

Can this PR be safely reverted and rolled back?

Uh oh!

vercel Bot commented Jul 10, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 10, 2025

👋 Greetings, Contributor!

Helpful Resources

PR Slash Commands

Uh oh!

David Gold (dbgold17) Jul 10, 2025

Choose a reason for hiding this comment

Uh oh!

Brian Lai (brianjlai) Jul 10, 2025

Choose a reason for hiding this comment

Uh oh!

David Gold (dbgold17) Jul 10, 2025

Choose a reason for hiding this comment

Uh oh!

David Gold (dbgold17) Jul 10, 2025

Choose a reason for hiding this comment

Uh oh!

Brian Lai (brianjlai) left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Jul 11, 2025

source-google-drive Connector Test Results

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

David Gold (dbgold17) commented Jul 10, 2025 •

edited

Loading

vercel Bot commented Jul 10, 2025 •

edited

Loading

`source-google-drive` Connector Test Results