[Snyk] Security upgrade python from 3.10.7-alpine to 3.13.0rc2-alpine

[gitafolabi]

Snyk has created this PR to fix 5 vulnerabilities in the dockerfile dependencies of this project.

Keeping your Docker base image up-to-date means you’ll benefit from security fixes in the latest version of your chosen image.

Snyk changed the following file(s):

• dbt/Dockerfile

We recommend upgrading to python:3.13.0rc2-alpine, as this image has only 0 known vulnerabilities. To do this, merge this pull request, then verify your application still works as expected.

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Out-of-bounds Read SNYK-ALPINE316-E2FSPROGS-3339843	614
	Use After Free SNYK-ALPINE316-EXPAT-3062883	614
	Double Free SNYK-ALPINE316-OPENSSL-3314624	614
	Access of Resource Using Incompatible Type ('Type Confusion') SNYK-ALPINE316-OPENSSL-3314641	614
	Out-of-Bounds SNYK-ALPINE316-SQLITE-6179509	614

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Double Free
🦉 Access of Resource Using Incompatible Type ('Type Confusion')
🦉 Use After Free

[//]: # 'snyk:metadata:{"customTemplate":{"variablesUsed":[],"fieldsUsed":[]},"dependencies":[{"name":"python","from":"3.10.7-alpine","to":"3.13.0rc2-alpine"}],"env":"prod","issuesToFix":[{"exploit_maturity":"No Known Exploit","id":"SNYK-ALPINE316-SQLITE-6179509","priority_score":614,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"severity","label":"high","score":400},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Out-of-Bounds"},{"exploit_maturity":"No Known Exploit","id":"SNYK-ALPINE316-OPENSSL-3314624","priority_score":614,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"severity","label":"high","score":400},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Double Free"},{"exploit_maturity":"No Known Exploit","id":"SNYK-ALPINE316-OPENSSL-3314641","priority_score":614,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"severity","label":"high","score":400},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Access of Resource Using Incompatible Type ('Type Confusion')"},{"exploit_maturity":"No Known Exploit","id":"SNYK-ALPINE316-E2FSPROGS-3339843","priority_score":614,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"severity","label":"high","score":400},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Out-of-bounds Read"},{"exploit_maturity":"No Known Exploit","id":"SNYK-ALPINE316-EXPAT-3062883","priority_score":614,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"severity","label":"high","score":400},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Use After Free"}],"prId":"d0b2acb2-f427-4dcb-87bb-0af0ea6fe80f","prPublicId":"d0b2acb2-f427-4dcb-87bb-0af0ea6fe80f","packageManager":"dockerfile","priorityScoreList":[614,614,614,614,614],"projectPublicId":"b1060fce-d57f-4dd8-a8bb-7c8fed8f8253","projectUrl":"https://app.snyk.io/org/gitafolabi/project/b1060fce-d57f-4dd8-a8bb-7c8fed8f8253?utm_source=github&utm_medium=referral&page=fix-pr","prType":"fix","templateFieldSources":{"branchName":"default","commitMessage":"default","description":"default","title":"default"},"templateVariants":["updated-fix-title","priorityScore"],"type":"auto","upgrade":["SNYK-ALPINE316-E2FSPROGS-3339843","SNYK-ALPINE316-EXPAT-3062883","SNYK-ALPINE316-OPENSSL-3314624","SNYK-ALPINE316-OPENSSL-3314641","SNYK-ALPINE316-SQLITE-6179509"],"vulns":["SNYK-ALPINE316-SQLITE-6179509","SNYK-ALPINE316-OPENSSL-3314624","SNYK-ALPINE316-OPENSSL-3314641","SNYK-ALPINE316-E2FSPROGS-3339843","SNYK-ALPINE316-EXPAT-3062883"],"patch":[],"isBreakingChange":false,"remediationStrategy":"vuln"}'

[dryrunsecurity]

DryRun Security Summary

The provided Dockerfile updates the Python version used in the base image from 3.10.7 to 3.13.0rc2, which is a significant change that requires thorough testing to ensure compatibility, and the Dockerfile also uses the Alpine Linux-based Python image, sets environment variables, uses Poetry for dependency management, and includes a custom docker-entrypoint.sh script and a profiles-prod.yml file.

Expand for full summary

Summary:

The code change in the provided Dockerfile is updating the Python version used in the base image from 3.10.7 to 3.13.0rc2. This is a significant change, as it involves moving to a newer, potentially less stable version of Python. It's important to thoroughly test the application to ensure that the upgrade does not introduce any regressions or compatibility issues.

Additionally, the Dockerfile is using the Alpine Linux-based Python image as the base, which is known for its small footprint and security-focused approach. However, it's crucial to ensure that the base image is kept up-to-date and that any known vulnerabilities are addressed. The Dockerfile also sets several environment variables and uses Poetry, a popular Python dependency management tool, to install the application's dependencies. It's essential to ensure that the dependencies are kept up-to-date and that any known vulnerabilities in the dependencies are addressed. Finally, the Dockerfile includes a custom docker-entrypoint.sh script and a profiles-prod.yml file, which should be reviewed to ensure that they do not introduce any security risks.

Files Changed:

• dbt/Dockerfile: This Dockerfile has been updated to use Python 3.13.0rc2 instead of 3.10.7 in the base stage of the multi-stage Docker build. The Dockerfile also sets several environment variables, uses Poetry for dependency management, and includes a custom docker-entrypoint.sh script and a profiles-prod.yml file.

Code Analysis

We ran 9 analyzers against 1 file and 1 analyzer had findings. 8 analyzers had no findings.

Analyzer	Findings
Sensitive Files Analyzer	1 finding

Riskiness

🟢 Risk threshold not exceeded.

View PR in the DryRun Dashboard.