Merge pull request #496 from jackseceng/3.15.0a6-upgrade

fix(python-vulns): Compiling python from source in dockerfile to avoi…

Author: jackseceng

Dockerfile

@@ -1,21 +1,35 @@
 # Stage 1: Build stage environment using alpine python Image
-FROM python:3.14-alpine3.22 AS build-env 
+FROM alpine:3.22 AS build-env
 
 # Set build directory
 WORKDIR /build
 
 # Copy application files
 COPY . .
 
-# Install python dependencies into a target directory
+# Build Python 3.15.0a6 and apk dependencies from source
 RUN set -e; \
     apk add --no-cache \
     build-base=0.5-r3 \
     cmake=3.31.7-r1 \
     coreutils=9.7-r1 \
-    libffi-dev=3.4.8-r0; \
-    pip install --no-cache-dir --upgrade 'pip==26.0'; \
-    pip install --no-cache-dir -r requirements.txt --target /packages;
+    libffi-dev=3.4.8-r0 \
+    openssl-dev=3.5.5-r0 \
+    zlib-dev=1.3.1-r2 \
+    bzip2-dev=1.0.8-r6 \
+    xz-dev=5.8.1-r0 \
+    wget=1.25.0-r1; \
+    wget --progress=dot:giga https://www.python.org/ftp/python/3.15.0/Python-3.15.0a6.tgz; \
+    tar -xzf Python-3.15.0a6.tgz; \
+    ./Python-3.15.0a6/configure --prefix=/usr/local --enable-shared --with-ensurepip=install; \
+    make -j"$(nproc)"; \
+    make install; \
+    ln -s /usr/local/bin/python3.15 /usr/local/bin/python;
+
+# Install python dependencies into a target directory
+RUN set -e; \
+    pip3.15 install --no-cache-dir --upgrade 'pip==26.0'; \
+    PYO3_USE_ABI3_FORWARD_COMPATIBILITY=1 pip3.15 install --no-cache-dir -r requirements.txt --target /packages;
 
 
 # Stage 2: Runtime Stage using scratch Image
@@ -24,12 +38,13 @@ FROM scratch
 # Copy necessary system libraries and interpreter from build-env
 COPY --from=build-env /lib/ld-musl-x86_64.so.1 /lib/ld-musl-x86_64.so.1
 COPY --from=build-env /lib/libc.musl-x86_64.so.1 /lib/libc.musl-x86_64.so.1
-COPY --from=build-env /usr/local/lib/libpython3.14.so.1.0 /usr/local/lib/libpython3.14.so.1.0
-COPY --from=build-env /usr/local/lib/python3.14 /usr/local/lib/python3.14
+COPY --from=build-env /usr/local/lib/libpython3.15.so.1.0 /usr/local/lib/libpython3.15.so.1.0
+COPY --from=build-env /usr/local/lib/python3.15 /usr/local/lib/python3.15
 COPY --from=build-env /usr/lib/libssl.so.3 /usr/lib/libssl.so.3
 COPY --from=build-env /usr/lib/libcrypto.so.3 /usr/lib/libcrypto.so.3
 COPY --from=build-env /usr/lib/libz.so.1 /usr/lib/libz.so.1
 COPY --from=build-env /usr/lib/libgcc_s.so.1 /usr/lib/libgcc_s.so.1
+COPY --from=build-env /usr/lib/libffi.so.8 /usr/lib/libffi.so.8
 
 # Copy Python installation
 COPY --from=build-env /usr/local/bin/python /usr/local/bin/python