From 8a7107d4dbb15afda032235394063bec28cef17a Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 12 Nov 2026 20:36:00 +0000 Subject: [PATCH] Build(deps): Bump the base-images group across 2 directories with 2 updates Bumps the base-images group with 2 updates in the /skills/agentbase-build-mcp-server/assets/mcp_server directory: [astral-sh/uv](https://github.com/astral-sh/uv) and python. Bumps the base-images group with 2 updates in the /skills/agentbase-build-scaffold/assets/backend directory: [astral-sh/uv](https://github.com/astral-sh/uv) and python. Updates `astral-sh/uv` from `af22a52` to `5cc1805` - [Release notes](https://github.com/astral-sh/uv/releases) - [Changelog](https://github.com/astral-sh/uv/blob/main/CHANGELOG.md) - [Commits](https://github.com/astral-sh/uv/compare/0.13.0...0.13.0) Updates `python` from 3.13-slim to 3.15-slim Updates `python` from 3.13-slim to 3.15-slim Updates `astral-sh/uv` from `af22a52` to `5cc1805` - [Release notes](https://github.com/astral-sh/uv/releases) - [Changelog](https://github.com/astral-sh/uv/blob/main/CHANGELOG.md) - [Commits](https://github.com/astral-sh/uv/compare/0.13.0...0.13.0) Updates `python` from 3.13-slim to 3.15-slim Updates `python` from 3.13-slim to 3.15-slim --- updated-dependencies: - dependency-name: astral-sh/uv dependency-version: '0.13' dependency-type: direct:production update-type: version-update:semver-patch dependency-group: base-images - dependency-name: python dependency-version: 3.15-slim dependency-type: direct:production dependency-group: base-images - dependency-name: python dependency-version: 3.15-slim dependency-type: direct:production dependency-group: base-images - dependency-name: astral-sh/uv dependency-version: '0.13' dependency-type: direct:production update-type: version-update:semver-patch dependency-group: base-images - dependency-name: python dependency-version: 3.15-slim dependency-type: direct:production dependency-group: base-images - dependency-name: python dependency-version: 3.15-slim dependency-type: direct:production dependency-group: base-images ... Signed-off-by: dependabot[bot] --- .../agentbase-build-mcp-server/assets/mcp_server/Dockerfile | 6 +++--- skills/agentbase-build-scaffold/assets/backend/Dockerfile | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/skills/agentbase-build-mcp-server/assets/mcp_server/Dockerfile b/skills/agentbase-build-mcp-server/assets/mcp_server/Dockerfile index 6ab9e8c..54a902f 100644 --- a/skills/agentbase-build-mcp-server/assets/mcp_server/Dockerfile +++ b/skills/agentbase-build-mcp-server/assets/mcp_server/Dockerfile @@ -3,8 +3,8 @@ # Two stages: uv and its cache stay in the builder; the runtime image only gets Python, the venv and the code. # Base images are pinned by digest (the tag stays for readability): a build never changes under you. Dependabot's # docker ecosystem proposes the new digests; both Dockerfiles of these skills move together (check_skills.py). -FROM ghcr.io/astral-sh/uv:0.13@sha256:af22a52f5eafef3d78e551599d405c02df61919d18028f0cea8eda93bc9986d0 AS uv -FROM python:3.13-slim@sha256:2d44738ebf4ce5f63b9d9ea871e9c7cfdc0426f7b0c97cac915fd88ded1d86bb AS builder +FROM ghcr.io/astral-sh/uv:0.13@sha256:5cc1805e2426484abca4ad46ea783bab281fdb225fd82d8ce6d66a81254bac85 AS uv +FROM python:3.15-slim@sha256:65a65fc7b30b06cb6df4930fd4650697cb23f4c2698ab81fc87e4b031bc36928 AS builder COPY --from=uv /uv /bin/uv ENV UV_COMPILE_BYTECODE=1 UV_LINK_MODE=copy UV_PYTHON_DOWNLOADS=never WORKDIR /app @@ -14,7 +14,7 @@ RUN uv sync --locked --no-dev --no-install-project COPY . . RUN uv sync --locked --no-dev -FROM python:3.13-slim@sha256:2d44738ebf4ce5f63b9d9ea871e9c7cfdc0426f7b0c97cac915fd88ded1d86bb +FROM python:3.15-slim@sha256:65a65fc7b30b06cb6df4930fd4650697cb23f4c2698ab81fc87e4b031bc36928 # /app stays owned by root (read-only for the server user) — no `chown -R` layer. The throwaway SQLite demo # (MCP_ALLOW_SQLITE=true) therefore writes to /tmp; production uses Postgres (store.py). ENV PYTHONUNBUFFERED=1 PATH="/app/.venv/bin:$PATH" MCP_APP_ENV=prod MCP_DB_PATH=/tmp/mcp.db diff --git a/skills/agentbase-build-scaffold/assets/backend/Dockerfile b/skills/agentbase-build-scaffold/assets/backend/Dockerfile index 5f3a02e..5f2fdfe 100644 --- a/skills/agentbase-build-scaffold/assets/backend/Dockerfile +++ b/skills/agentbase-build-scaffold/assets/backend/Dockerfile @@ -2,8 +2,8 @@ # Two stages: uv and its cache stay in the builder; the runtime image only gets Python, the venv and the code. # Base images are pinned by digest (the tag stays for readability): a build never changes under you. Dependabot's # docker ecosystem proposes the new digests; both Dockerfiles of these skills move together (check_skills.py). -FROM ghcr.io/astral-sh/uv:0.13@sha256:af22a52f5eafef3d78e551599d405c02df61919d18028f0cea8eda93bc9986d0 AS uv -FROM python:3.13-slim@sha256:2d44738ebf4ce5f63b9d9ea871e9c7cfdc0426f7b0c97cac915fd88ded1d86bb AS builder +FROM ghcr.io/astral-sh/uv:0.13@sha256:5cc1805e2426484abca4ad46ea783bab281fdb225fd82d8ce6d66a81254bac85 AS uv +FROM python:3.15-slim@sha256:65a65fc7b30b06cb6df4930fd4650697cb23f4c2698ab81fc87e4b031bc36928 AS builder COPY --from=uv /uv /bin/uv @@ -21,7 +21,7 @@ COPY . . RUN uv sync --locked --no-dev && python -m compileall -q main.py app # python:3.13-slim ships /usr/share/zoneinfo; the tzdata package in the venv covers APP_TIMEZONE regardless -FROM python:3.13-slim@sha256:2d44738ebf4ce5f63b9d9ea871e9c7cfdc0426f7b0c97cac915fd88ded1d86bb +FROM python:3.15-slim@sha256:65a65fc7b30b06cb6df4930fd4650697cb23f4c2698ab81fc87e4b031bc36928 # Release shown in Langfuse (tracing `release`) = the image tag: `make docker-build` and CI pass --build-arg. # A deploy env file must not set AGENT_VERSION (it would override this value).