Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Packaging] Bump embedded Python version to 3.11.5 #26749

Merged
merged 8 commits into from
Oct 8, 2023

Conversation

bebound
Copy link
Contributor

@bebound bebound commented Jun 25, 2023

Description

Fix #26740, CVE-2023-0464, CVE-2023-0466, CVE-2023-24329 are fixed in Python 3.11.4

The user may need to reinstall their extensions if the dependency provides different wheels for different python version.

PS: scripts/release/debian/Dockerfile is only used in scripts/release/debian/README.md, which is also deprecated. So I don't update its version number.

Related issue: #24494


This checklist is used to make sure that common guidelines for a pull request are followed.

@azure-client-tools-bot-prd
Copy link

Hi @bebound,
Since the current milestone time is less than 7 days, this pr will be reviewed in the next milestone.

@azure-client-tools-bot-prd
Copy link

azure-client-tools-bot-prd bot commented Jun 25, 2023

🔄AzureCLI-FullTest
️✔️acr
️✔️2020-09-01-hybrid
️✔️3.10
️✔️3.9
️✔️latest
️✔️3.10
️✔️3.9
️✔️acs
️✔️2020-09-01-hybrid
️✔️3.10
️✔️3.9
️✔️latest
️✔️3.10
️✔️3.9
️✔️advisor
️✔️latest
️✔️3.10
️✔️3.9
️✔️ams
️✔️latest
️✔️3.10
️✔️3.9
️✔️apim
️✔️latest
️✔️3.10
️✔️3.9
️✔️appconfig
️✔️latest
️✔️3.10
️✔️3.9
️✔️appservice
️✔️latest
️✔️3.10
️✔️3.9
️✔️aro
️✔️latest
️✔️3.10
️✔️3.9
️✔️backup
️✔️latest
️✔️3.10
️✔️3.9
️✔️batch
️✔️latest
️✔️3.10
️✔️3.9
️✔️batchai
️✔️latest
️✔️3.10
️✔️3.9
️✔️billing
️✔️latest
️✔️3.10
️✔️3.9
️✔️botservice
️✔️latest
️✔️3.10
️✔️3.9
️✔️cdn
️✔️latest
️✔️3.10
️✔️3.9
️✔️cloud
️✔️latest
️✔️3.10
️✔️3.9
️✔️cognitiveservices
️✔️latest
️✔️3.10
️✔️3.9
️✔️config
️✔️latest
️✔️3.10
️✔️3.9
️✔️configure
️✔️latest
️✔️3.10
️✔️3.9
️✔️consumption
️✔️latest
️✔️3.10
️✔️3.9
️✔️container
️✔️latest
️✔️3.10
️✔️3.9
🔄containerapp
🔄latest
🔄3.10
️✔️3.9
️✔️core
️✔️2018-03-01-hybrid
️✔️3.10
️✔️3.9
️✔️2019-03-01-hybrid
️✔️3.10
️✔️3.9
️✔️2020-09-01-hybrid
️✔️3.10
️✔️3.9
️✔️latest
️✔️3.10
️✔️3.9
️✔️cosmosdb
️✔️latest
️✔️3.10
️✔️3.9
️✔️databoxedge
️✔️2019-03-01-hybrid
️✔️3.10
️✔️3.9
️✔️2020-09-01-hybrid
️✔️3.10
️✔️3.9
️✔️latest
️✔️3.10
️✔️3.9
️✔️dla
️✔️latest
️✔️3.10
️✔️3.9
️✔️dls
️✔️latest
️✔️3.10
️✔️3.9
️✔️dms
️✔️latest
️✔️3.10
️✔️3.9
️✔️eventgrid
️✔️latest
️✔️3.10
️✔️3.9
️✔️eventhubs
️✔️latest
️✔️3.10
️✔️3.9
️✔️feedback
️✔️latest
️✔️3.10
️✔️3.9
️✔️find
️✔️latest
️✔️3.10
️✔️3.9
️✔️hdinsight
️✔️latest
️✔️3.10
️✔️3.9
️✔️identity
️✔️latest
️✔️3.10
️✔️3.9
️✔️iot
️✔️2019-03-01-hybrid
️✔️3.10
️✔️3.9
️✔️2020-09-01-hybrid
️✔️3.10
️✔️3.9
️✔️latest
️✔️3.10
️✔️3.9
️✔️keyvault
️✔️2018-03-01-hybrid
️✔️3.10
️✔️3.9
️✔️2020-09-01-hybrid
️✔️3.10
️✔️3.9
️✔️latest
️✔️3.10
️✔️3.9
️✔️kusto
️✔️latest
️✔️3.10
️✔️3.9
️✔️lab
️✔️latest
️✔️3.10
️✔️3.9
️✔️managedservices
️✔️latest
️✔️3.10
️✔️3.9
️✔️maps
️✔️latest
️✔️3.10
️✔️3.9
️✔️marketplaceordering
️✔️latest
️✔️3.10
️✔️3.9
️✔️monitor
️✔️latest
️✔️3.10
️✔️3.9
️✔️mysql
️✔️latest
️✔️3.10
️✔️3.9
️✔️netappfiles
️✔️latest
️✔️3.10
️✔️3.9
️✔️network
️✔️2018-03-01-hybrid
️✔️3.10
️✔️3.9
️✔️latest
️✔️3.10
️✔️3.9
️✔️policyinsights
️✔️latest
️✔️3.10
️✔️3.9
️✔️privatedns
️✔️latest
️✔️3.10
️✔️3.9
️✔️profile
️✔️latest
️✔️3.10
️✔️3.9
️✔️rdbms
️✔️latest
️✔️3.10
️✔️3.9
️✔️redis
️✔️latest
️✔️3.10
️✔️3.9
️✔️relay
️✔️latest
️✔️3.10
️✔️3.9
️✔️resource
️✔️2018-03-01-hybrid
️✔️3.10
️✔️3.9
️✔️2019-03-01-hybrid
️✔️3.10
️✔️3.9
️✔️latest
️✔️3.10
️✔️3.9
️✔️role
️✔️latest
️✔️3.10
️✔️3.9
️✔️search
️✔️latest
️✔️3.10
️✔️3.9
️✔️security
️✔️latest
️✔️3.10
️✔️3.9
️✔️servicebus
️✔️latest
️✔️3.10
️✔️3.9
️✔️serviceconnector
️✔️latest
️✔️3.10
️✔️3.9
️✔️servicefabric
️✔️latest
️✔️3.10
️✔️3.9
️✔️signalr
️✔️latest
️✔️3.10
️✔️3.9
️✔️sql
️✔️latest
️✔️3.10
️✔️3.9
️✔️sqlvm
️✔️latest
️✔️3.10
️✔️3.9
️✔️storage
️✔️2018-03-01-hybrid
️✔️3.10
️✔️3.9
️✔️2019-03-01-hybrid
️✔️3.10
️✔️3.9
️✔️2020-09-01-hybrid
️✔️3.10
️✔️3.9
️✔️latest
️✔️3.10
️✔️3.9
️✔️synapse
️✔️latest
️✔️3.10
️✔️3.9
️✔️telemetry
️✔️2018-03-01-hybrid
️✔️3.10
️✔️3.9
️✔️2019-03-01-hybrid
️✔️3.10
️✔️3.9
️✔️2020-09-01-hybrid
️✔️3.10
️✔️3.9
️✔️latest
️✔️3.10
️✔️3.9
️✔️util
️✔️latest
️✔️3.10
️✔️3.9
️✔️vm
️✔️2018-03-01-hybrid
️✔️3.10
️✔️3.9
️✔️2019-03-01-hybrid
️✔️3.10
️✔️3.9
️✔️2020-09-01-hybrid
️✔️3.10
️✔️3.9
️✔️latest
️✔️3.10
️✔️3.9

@ghost ghost requested a review from jiasli June 25, 2023 02:46
@azure-client-tools-bot-prd
Copy link

azure-client-tools-bot-prd bot commented Jun 25, 2023

️✔️AzureCLI-BreakingChangeTest
️✔️Non Breaking Changes

@ghost ghost requested a review from wangzelin007 June 25, 2023 02:46
@yonzhan
Copy link
Collaborator

yonzhan commented Jun 25, 2023

Packaging

@ghost ghost requested a review from yonzhan June 25, 2023 02:46
@ghost ghost added the Auto-Assign Auto assign by bot label Jun 25, 2023
@ghost ghost assigned bebound Jun 25, 2023
@ghost ghost added the Packaging label Jun 25, 2023
@bebound bebound closed this Jun 25, 2023
@bebound
Copy link
Contributor Author

bebound commented Jun 25, 2023

Close as Python 3.10.12 does not contains binary installers.
Python 3.10 is now in the "security fixes only" stage of its life cycle, which pushes us to use Python 3.11 instead.

https://www.python.org/downloads/release/python-31012/

@bebound bebound reopened this Jul 18, 2023
@bebound bebound changed the title {Packaging} Bump Python version to 3.10.12 {Packaging} Bump Python version to 3.11.4 Jul 18, 2023
# Conflicts:
#	build_scripts/windows/scripts/build.cmd
#	scripts/release/homebrew/docker/formula_generate.py
@bebound bebound changed the title {Packaging} Bump Python version to 3.11.4 {Packaging} Bump Python version to 3.11.5 Aug 25, 2023
@bebound bebound marked this pull request as ready for review September 11, 2023 07:17
Comment on lines +128 to +131
# update python version
text = re.sub('depends_on "python@.*"', f'depends_on "python@{PYTHON_VERSION}"', text, 1)
text = re.sub(r'virtualenv_create\(libexec, "python.*"', f'virtualenv_create(libexec, "python{PYTHON_VERSION}"', text, 1) # pylint: disable=line-too-long

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should these lines be dropped in the next release? It is really inconvenient to make any change to the formula.

Or, can we just keep the formula as is and make the change when a PR is submitted for https://github.com/Homebrew/homebrew-core/blob/master/Formula/a/azure-cli.rb ?

In my thought, the Azure CLI repo should be self-contained - it should never depend on external resources to build and install.

Copy link
Contributor Author

@bebound bebound Sep 18, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I prefer to keep it here for two reasons.

  1. TestHomebrewFormula can check whether new formula works with new Python.
  2. Homebrew users can use the new Python version as soon as possible.

For other changes like the without_pip: false in #27186, we can create a PR for homebrew.

Sometimes the Homebrew community update our formula, which cause a conflict, so we modify the external formula. This behavior is introduced in #11964

@bebound bebound changed the title {Packaging} Bump Python version to 3.11.5 [Packaging] Bump Bundled Python version to 3.11.5 Oct 8, 2023
@bebound bebound changed the title [Packaging] Bump Bundled Python version to 3.11.5 [Packaging] Bump embedded Python version to 3.11.5 Oct 8, 2023
@bebound bebound merged commit 04d82da into Azure:dev Oct 8, 2023
54 checks passed
@bebound bebound deleted the bump-python branch October 8, 2023 02:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Auto-Assign Auto assign by bot Packaging
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Bundled Python version has multiple vulnerabilities
3 participants