Merge remote-tracking branch 'origin/main' into docker-images-statsd

Author: NickLarsenNZ

.scripts/upload_new_statsd_exporter_version.sh

@@ -0,0 +1,53 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+VERSION=${1:?"Missing version number argument (arg 1)"}
+NEXUS_USER=${2:?"Missing Nexus username argument (arg 2)"}
+
+read -r -s -p "Nexus Password: " NEXUS_PASSWORD
+echo ""
+
+# https://stackoverflow.com/questions/4632028/how-to-create-a-temporary-directory
+# Find the directory name of the script
+DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
+
+# the temp directory used, within $DIR
+WORK_DIR=$(mktemp -d -p "$DIR")
+
+# check if tmp dir was created
+if [[ ! "$WORK_DIR" || ! -d "$WORK_DIR" ]]; then
+  echo "Could not create temp dir"
+  exit 1
+fi
+
+# deletes the temp directory
+function cleanup {
+  rm -rf "$WORK_DIR"
+}
+
+# register the cleanup function to be called on the EXIT signal
+trap cleanup EXIT
+
+cd "$WORK_DIR" || exit
+
+# statsd_exporter does not currently publish signatures or SBOMs
+DOWNLOAD_URL="https://github.com/prometheus/statsd_exporter/archive/refs/tags/v$VERSION.tar.gz"
+
+echo "Downloading statsd_exporter source"
+if ! curl --fail -Ls -O "$DOWNLOAD_URL"; then
+  echo "Failed to download from $DOWNLOAD_URL"
+  exit 1
+fi
+
+FILE_NAME="statsd_exporter-$VERSION.src.tar.gz"
+mv "v$VERSION.tar.gz" "$FILE_NAME"
+
+echo "Uploading statsd_exporter source to Nexus"
+if ! curl --fail -o /dev/null --progress-bar -u "$NEXUS_USER:$NEXUS_PASSWORD" --upload-file "$FILE_NAME" 'https://repo.stackable.tech/repository/packages/statsd_exporter/'; then
+  echo "Failed to upload statsd_exporter source to Nexus"
+  exit 1
+fi
+
+echo "Successfully uploaded new version of statsd_exporter source ($VERSION) to Nexus"
+echo "https://repo.stackable.tech/service/rest/repository/browse/packages/statsd_exporter/"

CHANGELOG.md

@@ -14,11 +14,17 @@ All notable changes to this project will be documented in this file.
 - opa: Add `1.16.2` ([#1509]).
 - kafka: Add `3.9.2` and `4.2.1` ([#1483]).
 - trino: Add `481` ([#1518]).
+- superset: Add `6.1.0` ([#1514])
+- zookeeper: Add `3.9.5` ([#1515])
 
 ### Changed
 
-- hbase: Update `hbase-opa-authorizer` from `0.1.0` to `0.2.0` and then `0.3.0` ([#1446], [#1454]).
+- airflow: Bump statsd_exporter to `0.29.0` ([#1522]).
 - ci: Bump `docker/login-action` from `v3.6.0` to `v4.1.0` and `stackabletech/actions` to `v0.14.3` to escape Node.js 20 deprecation ([#1507]).
+- hbase: Update `hbase-opa-authorizer` from `0.1.0` to `0.2.0` and then `0.3.0` ([#1446], [#1454]).
+- stackable-base: Bump `containerdebug` to `0.4.0` and  `config-utils` to `0.4.0` ([#1521]).
+- statsd_exporter: Bump version from `0.28.0` to `0.29.0` ([#1522]).
+- superset: Bump statsd_exporter to `0.29.0` ([#1522]).
 
 ### Fixed
 
@@ -31,6 +37,7 @@ All notable changes to this project will be documented in this file.
 
 ### Removed
 
+- nifi: Remove `1.28.1`, deprecate `2.7.2` ([#1520]).
 - opa: Remove `1.8.0` ([#1509]).
 
 [#1446]: https://github.com/stackabletech/docker-images/pull/1446
@@ -49,7 +56,11 @@ All notable changes to this project will be documented in this file.
 [#1509]: https://github.com/stackabletech/docker-images/pull/1509
 [#1510]: https://github.com/stackabletech/docker-images/pull/1510
 [#1512]: https://github.com/stackabletech/docker-images/pull/1512
+[#1514]: https://github.com/stackabletech/docker-images/pull/1514
+[#1515]: https://github.com/stackabletech/docker-images/pull/1515
 [#1518]: https://github.com/stackabletech/docker-images/pull/1518
+[#1520]: https://github.com/stackabletech/docker-images/pull/1520
+[#1521]: https://github.com/stackabletech/docker-images/pull/1521
 
 ## [26.3.0] - 2026-03-16
 

airflow/boil-config.toml

@@ -3,7 +3,7 @@
 
 # Deprecated since SDP 25.11
 [versions."2.9.3".local-images]
-"shared/statsd-exporter" = "0.28.0"
+"shared/statsd-exporter" = "0.29.0"
 vector = "0.55.0"
 stackable-devel = "1.0.0"
 
@@ -20,7 +20,7 @@ nodejs-version = "20"
 
 # LTS
 [versions."3.0.6".local-images]
-"shared/statsd-exporter" = "0.28.0"
+"shared/statsd-exporter" = "0.29.0"
 vector = "0.55.0"
 stackable-devel = "1.0.0"
 
@@ -56,7 +56,7 @@ nodejs-version = "20"
 
 # Supported
 [versions."3.1.6".local-images]
-"shared/statsd-exporter" = "0.28.0"
+"shared/statsd-exporter" = "0.29.0"
 vector = "0.55.0"
 stackable-devel = "1.0.0"
 

nifi/boil-config.toml

@@ -1,17 +1,6 @@
 [metadata.registries]
 "oci.stackable.tech" = { namespace = "sdp" }
 
-[versions."1.28.1".local-images]
-java-base = "11"
-java-devel = "11"
-"shared/logback" = "1.3.14" # https://github.com/apache/nifi/blob/rel/nifi-1.28.1/pom.xml#L146
-
-[versions."1.28.1".build-arguments]
-git-sync-version = "v4.4.1"
-# Check for new versions at the upstream: https://github.com/stackabletech/nifi-opa-plugin/tags
-# Checkout a Patchable version (patch-series) for the new tag
-nifi-opa-authorizer-plugin-version = "0.5.0"
-
 [versions."2.6.0".local-images]
 java-base = "21"
 java-devel = "21"
@@ -27,6 +16,7 @@ nifi-opa-authorizer-plugin-version = "0.5.0"
 # Checkout a Patchable version (patch-series) for the new tag
 nifi-iceberg-bundle-version = "0.0.5"
 
+# Deprecated since 26.7.0
 [versions."2.7.2".local-images]
 java-base = "21" # As stated in GitHub README
 java-devel = "21"

shared/statsd-exporter/boil-config.toml

@@ -1,14 +1,14 @@
 [metadata]
 "oci.stackable.tech" = { namespace = "sdp" }
 
-[versions."0.28.0".build-arguments]
-# Find this in https://github.com/prometheus/statsd_exporter/blob/v0.28.0/go.mod
+[versions."0.29.0".build-arguments]
+# Find this in https://github.com/prometheus/statsd_exporter/blob/v0.29.0/go.mod
 # You can find the latest patch version at: https://go.dev/doc/devel/release
 # Mirror golang (no `v` prefix) via https://github.com/stackabletech/docker-images/actions/workflows/mirror.yaml
 # Note: currently mirrored to the `sdp` project, but should probably move elsewhere.
 golang-version = "1.22.12"
 # We use version 1.7.0, since a newer version of cyclonedx-gomod is not compatible with the version of Golang (>= 1.23.1)
 cyclonedx-gomod-version = "1.7.0"
 
-[versions."0.28.0".local-images]
+[versions."0.29.0".local-images]
 stackable-devel = "1.0.0"

stackable-base/Dockerfile

@@ -11,10 +11,10 @@ FROM local-image/stackable-devel AS rust-binaries
 
 # Find the latest version here: https://github.com/stackabletech/config-utils/tags
 # renovate: datasource=github-tags packageName=stackabletech/config-utils
-ENV CONFIG_UTILS_VERSION=0.3.0
+ENV CONFIG_UTILS_VERSION=0.4.0
 # Find the latest version here: https://github.com/stackabletech/containerdebug/tags
 # renovate: datasource=github-tags packageName=stackabletech/containerdebug
-ENV CONTAINERDEBUG_VERSION=0.3.0
+ENV CONTAINERDEBUG_VERSION=0.4.0
 # Find the latest version here: https://github.com/stackabletech/secret-operator/tags
 # I could not find support for prefixes or regex in https://docs.renovatebot.com/modules/datasource/github-tags/,
 # so I was unable to add a renovate hint.

superset/boil-config.toml

@@ -2,31 +2,60 @@
 "oci.stackable.tech" = { namespace = "sdp" }
 
 [versions."4.1.4".local-images]
-"shared/statsd-exporter" = "0.28.0"
+"shared/statsd-exporter" = "0.29.0"
 stackable-devel = "1.0.0"
 vector = "0.55.0"
 
 [versions."4.1.4".build-arguments]
 cyclonedx-bom-version = "6.0.0"
-# Find the flask-appbuilder version in the applicable constraints.txt file, then find the authlib version.
-# https://github.com/dpgaspar/Flask-AppBuilder/blob/release/4.5.0/requirements/extra.txt#L7
+# flask-appbuilder==4.5.0 is pinned in https://github.com/apache/superset/blob/4.1.4/requirements/base.txt (search for `flask-appbuilder==`),
+# which in turn pins authlib in https://github.com/dpgaspar/Flask-AppBuilder/blob/release/4.5.0/requirements/extra.txt (search for `authlib==`)
 authlib-version = "1.2.1"
-python-version = "3.9"
-uv-version = "0.7.3"
-nodejs-version = "20.20.2"
+# The default upstream image is built on Python 3.11 (`ARG PY_VER` in https://github.com/apache/superset/blob/4.1.4/Dockerfile)
+# and upstream CI tests 3.10 and 3.11 (https://github.com/apache/superset/blob/4.1.4/.github/actions/setup-backend/action.yml)
+python-version = "3.11"
+# Independent of Superset, use the latest release: https://github.com/astral-sh/uv/releases
+uv-version = "0.11.18"
+# https://github.com/apache/superset/blob/4.1.4/superset-frontend/.nvmrc
+nodejs-version = "18.20.1"
+# Independent of Superset, use the latest release: https://github.com/nvm-sh/nvm/releases
 nvm-version = "v0.40.4"
 
 [versions."6.0.0".local-images]
-"shared/statsd-exporter" = "0.28.0"
+"shared/statsd-exporter" = "0.29.0"
 stackable-devel = "1.0.0"
 vector = "0.55.0"
 
 [versions."6.0.0".build-arguments]
 cyclonedx-bom-version = "6.0.0"
-# Find the flask-appbuilder version in the applicable constraints.txt file, then find the authlib version.
-# https://github.com/dpgaspar/Flask-AppBuilder/blob/release/5.0.0/requirements/extra.txt#L7
+# flask-appbuilder==5.0.0 is pinned in https://github.com/apache/superset/blob/6.0.0/requirements/base.txt (search for `flask-appbuilder==`),
+# which in turn pins authlib in https://github.com/dpgaspar/Flask-AppBuilder/blob/release/5.0.0/requirements/extra.txt (search for `authlib==`)
 authlib-version = "1.2.1"
-python-version = "3.11"
-uv-version = "0.7.3"
-nodejs-version = "20.20.2"
+# Upstream CI tests 3.10, 3.11 and 3.12, choosing the newest Python version
+python-version = "3.12"
+# Independent of Superset, use the latest release: https://github.com/astral-sh/uv/releases
+uv-version = "0.11.18"
+# https://github.com/apache/superset/blob/6.0.0/superset-frontend/.nvmrc
+nodejs-version = "20.18.3"
+# Independent of Superset, use the latest release: https://github.com/nvm-sh/nvm/releases
+nvm-version = "v0.40.4"
+
+[versions."6.1.0".local-images]
+"shared/statsd-exporter" = "0.28.0"
+stackable-devel = "1.0.0"
+vector = "0.55.0"
+
+[versions."6.1.0".build-arguments]
+cyclonedx-bom-version = "6.0.0"
+# flask-appbuilder==5.0.2 is pinned in https://github.com/apache/superset/blob/6.1.0/requirements/base.txt (search for `flask-appbuilder==`),
+# which in turn pins authlib in https://github.com/dpgaspar/Flask-AppBuilder/blob/release/5.0.2/requirements/extra.txt (search for `authlib==`)
+authlib-version = "1.2.1"
+# Upstream CI tests 3.10, 3.11 and 3.12 (https://github.com/apache/superset/blob/6.1.0/.github/actions/setup-backend/action.yml)
+# and a py312 image variant is published. We use 3.12
+python-version = "3.12"
+# Independent of Superset, use the latest release: https://github.com/astral-sh/uv/releases
+uv-version = "0.11.18"
+# https://github.com/apache/superset/blob/6.1.0/superset-frontend/.nvmrc
+nodejs-version = "22.22.0"
+# Independent of Superset, use the latest release: https://github.com/nvm-sh/nvm/releases
 nvm-version = "v0.40.4"

superset/gather-upstream-versions.sh

@@ -0,0 +1,78 @@
+#!/usr/bin/env bash
+# Determine the upstream-tested tool/dependency versions for a given Apache Superset
+# version, to fill in the `[versions."X.Y.Z".build-arguments]` section of
+# superset/boil-config.toml.
+#
+# Usage: ./upstream-versions.sh <superset-version>
+# Example: ./upstream-versions.sh 6.1.0
+#
+# Sources used:
+#   nodejs-version  -> superset-frontend/.nvmrc at the Superset tag
+#   flask-appbuilder -> requirements/base.txt at the Superset tag (informational; must
+#                       match the pin in superset/stackable/constraints/<version>/)
+#   authlib-version -> requirements/extra.txt at the matching Flask-AppBuilder release
+#   python-version  -> `ARG PY_VER` in the upstream Dockerfile (their default image),
+#                      plus the CI-tested versions from .github/actions/setup-backend.
+#                      Picking among the CI-tested versions is a human decision.
+#   uv/nvm-version  -> independent of Superset, latest GitHub release
+
+set -euo pipefail
+
+VERSION=${1:?Usage: $0 <superset-version> (e.g. 6.1.0)}
+RAW="https://raw.githubusercontent.com"
+
+fetch() {
+    curl --fail --silent --show-error --location "$1"
+}
+
+latest_release() {
+    fetch "https://api.github.com/repos/$1/releases/latest" \
+        | sed -nE 's/.*"tag_name": *"([^"]+)".*/\1/p' | head -1
+}
+
+# Node.js: pinned by upstream in superset-frontend/.nvmrc (strip the leading `v`)
+nodejs=$(fetch "$RAW/apache/superset/$VERSION/superset-frontend/.nvmrc" | tr -d 'v[:space:]')
+
+# Flask-AppBuilder: pinned in requirements/base.txt
+fab=$(fetch "$RAW/apache/superset/$VERSION/requirements/base.txt" \
+    | sed -nE 's/^flask-appbuilder==([0-9.]+).*/\1/p' | head -1)
+
+# Authlib: pinned by Flask-AppBuilder in requirements/extra.txt
+authlib=$(fetch "$RAW/dpgaspar/Flask-AppBuilder/release/$fab/requirements/extra.txt" \
+    | sed -nE 's/^authlib==([0-9.]+).*/\1/p' | head -1)
+
+# Python: the upstream image default (ARG PY_VER in the Dockerfile) ...
+py_default=$(fetch "$RAW/apache/superset/$VERSION/Dockerfile" \
+    | sed -nE 's/^ARG PY_VER=([0-9]+\.[0-9]+).*/\1/p' | head -1)
+# ... and all CI-tested versions (the previous/current/next aliases)
+py_tested=$(fetch "$RAW/apache/superset/$VERSION/.github/actions/setup-backend/action.yml" \
+    | sed -nE 's/.*PYTHON_VERSION=([0-9]+\.[0-9]+).*/\1/p' | sort -uV | xargs | sed 's/ /, /g')
+
+# uv and nvm are independent of Superset, use the latest release
+uv=$(latest_release astral-sh/uv)
+nvm=$(latest_release nvm-sh/nvm)
+
+cat <<EOF
+Superset $VERSION
+flask-appbuilder: $fab (informational, must match stackable/constraints/$VERSION/constraints.txt)
+authlib-version:  $authlib
+python-version:   $py_default (upstream image default; CI-tested: $py_tested)
+nodejs-version:   $nodejs
+uv-version:       $uv (latest release)
+nvm-version:      $nvm (latest release)
+EOF
+
+# Sanity check: the vendored constraints must pin the same Flask-AppBuilder version,
+# otherwise the authlib version derived above is based on the wrong FAB release.
+constraints="$(dirname "$0")/stackable/constraints/$VERSION/constraints.txt"
+if [ -f "$constraints" ]; then
+    local_fab=$(sed -nE 's/^flask-appbuilder==([0-9.]+).*/\1/p' "$constraints" | head -1)
+    if [ "$local_fab" != "$fab" ]; then
+        echo >&2
+        echo "WARNING: $constraints pins flask-appbuilder==$local_fab but upstream pins $fab" >&2
+        exit 1
+    fi
+else
+    echo >&2
+    echo "NOTE: no constraints file at $constraints yet - create it before building" >&2
+fi

superset/stackable/constraints/6.1.0/build-constraints.txt

@@ -0,0 +1,3 @@
+# It is not yet known how and when to change this
+# I will try without it overridden for now
+# Cython==3.0.12