Upgrade the hardened Python base images to Docker's latest patch releases

Generated-by: Claude Opus 5

Author: potiuk

Dockerfile

@@ -58,9 +58,9 @@ ARG AIRFLOW_VERSION="3.3.2"
 #
 # The FIPS-validated variants require a paid Docker subscription and cannot be mirrored or made the
 # default, but you can build a FIPS-compliant image by pointing the build at one:
-#   docker build . --build-arg BASE_IMAGE="dhi.io/python:3.13.15-debian12-fips-dev"
-ARG BASE_IMAGE="ghcr.io/apache/airflow/base/python:3.13.15-debian12-dev"
-ARG AIRFLOW_PYTHON_VERSION="3.13.15"
+#   docker build . --build-arg BASE_IMAGE="dhi.io/python:3.13.16-debian12-fips-dev"
+ARG BASE_IMAGE="ghcr.io/apache/airflow/base/python:3.13.16-debian12-dev"
+ARG AIRFLOW_PYTHON_VERSION="3.13.16"
 
 # You can swap comments between those two args to test pip from the main version
 # When you attempt to test if the version of `pip` from specified branch works for our builds

Dockerfile.ci

@@ -26,8 +26,8 @@
 #
 # The FIPS-validated variants require a paid Docker subscription and cannot be mirrored or made the
 # default, but you can build a FIPS-compliant image by pointing the build at one:
-#   docker build . --build-arg BASE_IMAGE="dhi.io/python:3.13.15-debian12-fips-dev"
-ARG BASE_IMAGE="ghcr.io/apache/airflow/base/python:3.13.15-debian12-dev"
+#   docker build . --build-arg BASE_IMAGE="dhi.io/python:3.13.16-debian12-fips-dev"
+ARG BASE_IMAGE="ghcr.io/apache/airflow/base/python:3.13.16-debian12-dev"
 
 ##############################################################################################
 # This is the script image where we keep all inlined bash scripts needed in other segments
@@ -1724,7 +1724,7 @@ ENV DEV_APT_COMMAND=${DEV_APT_COMMAND} \
     ADDITIONAL_DEV_APT_COMMAND=${ADDITIONAL_DEV_APT_COMMAND}
 
 
-ARG AIRFLOW_PYTHON_VERSION="3.13.15"
+ARG AIRFLOW_PYTHON_VERSION="3.13.16"
 ENV AIRFLOW_PYTHON_VERSION=${AIRFLOW_PYTHON_VERSION}
 ENV GOLANG_MAJOR_MINOR_VERSION="1.27.1"
 ENV TEMURIN_VERSION="11"

dev/breeze/src/airflow_breeze/global_constants.py

@@ -902,11 +902,11 @@ def get_airflow_extras():
 ]
 
 ALL_PYTHON_VERSION_TO_PATCHLEVEL_VERSION: dict[str, str] = {
-    "3.10": "3.10.21",
-    "3.11": "3.11.16",
-    "3.12": "3.12.14",
-    "3.13": "3.13.15",
-    "3.14": "3.14.3",
+    "3.10": "3.10.22",
+    "3.11": "3.11.17",
+    "3.12": "3.12.15",
+    "3.13": "3.13.16",
+    "3.14": "3.14.8",
 }
 
 # Airflow images are based on Docker Hardened Images (https://dhi.io). The "-dev" variant carries

docker-stack-docs/build-arg-ref.rst

@@ -32,7 +32,7 @@ Those are the most common arguments that you use when you want to build a custom
 +==========================================+===========================================+=============================================+
 | ``AIRFLOW_VERSION``                      | :subst-code:`|airflow-version|`           | Version of Airflow.                         |
 +------------------------------------------+-------------------------------------------+---------------------------------------------+
-| ``AIRFLOW_PYTHON_VERSION``               | ``3.13.15``                               | Python version recorded in the image        |
+| ``AIRFLOW_PYTHON_VERSION``               | ``3.13.16``                               | Python version recorded in the image        |
 |                                          |                                           | labels. The Python itself comes from        |
 |                                          |                                           | ``BASE_IMAGE``, so change both together.    |
 +------------------------------------------+-------------------------------------------+---------------------------------------------+
@@ -90,7 +90,7 @@ Those are the most common arguments that you use when you want to build a custom
 
 The default ``BASE_IMAGE`` is Airflow's public mirror of the `Docker Hardened Image <https://dhi.io>`_ for
 Python, tagged with the same Python version as ``AIRFLOW_PYTHON_VERSION`` - for Airflow |airflow-version| that
-is ``ghcr.io/apache/airflow/base/python:3.13.15-debian12-dev``. Pulling the mirror needs no credentials;
+is ``ghcr.io/apache/airflow/base/python:3.13.16-debian12-dev``. Pulling the mirror needs no credentials;
 pulling ``dhi.io`` directly requires a ``docker login dhi.io``.
 
 List of default extras in the production Dockerfile:

docker-stack-docs/docker-examples/customizing/add-build-essential-custom.sh

@@ -31,9 +31,9 @@ export DOCKER_BUILDKIT=1
 
 docker build . \
     --pull \
-    --build-arg BASE_IMAGE="ghcr.io/apache/airflow/base/python:3.13.15-debian12-dev" \
+    --build-arg BASE_IMAGE="ghcr.io/apache/airflow/base/python:3.13.16-debian12-dev" \
     --build-arg AIRFLOW_VERSION="${AIRFLOW_VERSION}" \
-    --build-arg AIRFLOW_PYTHON_VERSION="3.13.15" \
+    --build-arg AIRFLOW_PYTHON_VERSION="3.13.16" \
     --build-arg ADDITIONAL_PYTHON_DEPS="mpi4py==4.1.1" \
     --build-arg ADDITIONAL_DEV_APT_DEPS="libopenmpi-dev" \
     --build-arg ADDITIONAL_RUNTIME_APT_DEPS="openmpi-common" \

docker-stack-docs/docker-examples/customizing/custom-sources.sh

@@ -32,8 +32,8 @@ export DOCKER_BUILDKIT=1
 docker build . -f Dockerfile \
     --pull \
     --platform 'linux/amd64' \
-    --build-arg BASE_IMAGE="ghcr.io/apache/airflow/base/python:3.13.15-debian12-dev" \
-    --build-arg AIRFLOW_PYTHON_VERSION="3.13.15" \
+    --build-arg BASE_IMAGE="ghcr.io/apache/airflow/base/python:3.13.16-debian12-dev" \
+    --build-arg AIRFLOW_PYTHON_VERSION="3.13.16" \
     --build-arg AIRFLOW_VERSION="${AIRFLOW_VERSION}" \
     --build-arg ADDITIONAL_AIRFLOW_EXTRAS="slack,odbc" \
     --build-arg ADDITIONAL_PYTHON_DEPS=" \

docker-stack-docs/docker-examples/customizing/pypi-dev-runtime-deps.sh

@@ -32,8 +32,8 @@ export DOCKER_BUILDKIT=1
 
 docker build . \
     --pull \
-    --build-arg BASE_IMAGE="ghcr.io/apache/airflow/base/python:3.13.15-debian12-dev" \
-    --build-arg AIRFLOW_PYTHON_VERSION="3.13.15" \
+    --build-arg BASE_IMAGE="ghcr.io/apache/airflow/base/python:3.13.16-debian12-dev" \
+    --build-arg AIRFLOW_PYTHON_VERSION="3.13.16" \
     --build-arg AIRFLOW_VERSION="${AIRFLOW_VERSION}" \
     --build-arg ADDITIONAL_AIRFLOW_EXTRAS="jdbc" \
     --build-arg ADDITIONAL_PYTHON_DEPS="pandas==2.1.2" \

docker-stack-docs/docker-examples/customizing/pypi-extras-and-deps.sh

@@ -31,8 +31,8 @@ export DOCKER_BUILDKIT=1
 
 docker build . \
     --pull \
-    --build-arg BASE_IMAGE="ghcr.io/apache/airflow/base/python:3.13.15-debian12-dev" \
-    --build-arg AIRFLOW_PYTHON_VERSION="3.13.15" \
+    --build-arg BASE_IMAGE="ghcr.io/apache/airflow/base/python:3.13.16-debian12-dev" \
+    --build-arg AIRFLOW_PYTHON_VERSION="3.13.16" \
     --build-arg AIRFLOW_VERSION="${AIRFLOW_VERSION}" \
     --build-arg ADDITIONAL_AIRFLOW_EXTRAS="mssql,hdfs" \
     --build-arg ADDITIONAL_PYTHON_DEPS="oauth2client" \

docker-stack-docs/docker-examples/customizing/pypi-selected-version.sh

@@ -30,8 +30,8 @@ export AIRFLOW_VERSION=3.0.3
 export DOCKER_BUILDKIT=1
 
 docker build . \
-    --build-arg BASE_IMAGE="ghcr.io/apache/airflow/base/python:3.13.15-debian12-dev" \
-    --build-arg AIRFLOW_PYTHON_VERSION="3.13.15" \
+    --build-arg BASE_IMAGE="ghcr.io/apache/airflow/base/python:3.13.16-debian12-dev" \
+    --build-arg AIRFLOW_PYTHON_VERSION="3.13.16" \
     --build-arg AIRFLOW_VERSION="${AIRFLOW_VERSION}" \
     --tag "my-pypi-selected-version:0.0.1"
 # [END build]

docker-stack-docs/docker-examples/restricted/restricted_environments.sh

@@ -47,8 +47,8 @@ export DOCKER_BUILDKIT=1
 
 docker build . \
     --pull \
-    --build-arg BASE_IMAGE="ghcr.io/apache/airflow/base/python:3.13.15-debian12-dev" \
-    --build-arg AIRFLOW_PYTHON_VERSION="3.13.15" \
+    --build-arg BASE_IMAGE="ghcr.io/apache/airflow/base/python:3.13.16-debian12-dev" \
+    --build-arg AIRFLOW_PYTHON_VERSION="3.13.16" \
     --build-arg AIRFLOW_INSTALLATION_METHOD="apache-airflow" \
     --build-arg AIRFLOW_VERSION="${AIRFLOW_VERSION}" \
     --build-arg INSTALL_MYSQL_CLIENT="false" \