Merge pull request #109 from cisagov/maintenance/update_dependencies

Update image dependencies

Dockerfile

@@ -6,7 +6,7 @@
 # in the Python Docker image we use for the build-stage. The tag of the Python
 # Docker image matches the version of the python3 package available on Alpine
 # for consistency.
-FROM docker.io/library/alpine:3.19 AS compile-stage
+FROM docker.io/library/alpine:3.21 AS compile-stage
 
 ###
 # Unprivileged user variables
@@ -16,18 +16,18 @@ ENV CISA_HOME="/home/${CISA_USER}"
 ENV VIRTUAL_ENV="${CISA_HOME}/.venv"
 
 # Versions of the Python packages installed directly
-ENV PYTHON_PIP_VERSION=24.0
-ENV PYTHON_PIPENV_VERSION=2023.12.1
-ENV PYTHON_SETUPTOOLS_VERSION=69.2.0
-ENV PYTHON_WHEEL_VERSION=0.43.0
+ENV PYTHON_PIP_VERSION=24.3.1
+ENV PYTHON_PIPENV_VERSION=2024.4.0
+ENV PYTHON_SETUPTOOLS_VERSION=75.8.0
+ENV PYTHON_WHEEL_VERSION=0.45.1
 
 RUN apk --no-cache add \
-  py3-lxml=4.9.3-r1 \
-  py3-pip=23.3.1-r0 \
+  py3-lxml=5.3.0-r0 \
+  py3-pip=24.3.1-r0 \
   py3-setuptools=70.3.0-r0 \
-  py3-wheel=0.42.0-r0 \
-  python3-dev=3.11.11-r0 \
-  python3=3.11.11-r0
+  py3-wheel=0.43.0-r0 \
+  python3-dev=3.12.8-r1 \
+  python3=3.12.8-r1
 
 ###
 # Create a Python virtual environment (venv) for setup (due to PEP 668); install the
@@ -70,7 +70,7 @@ RUN pipenv check --verbose \
 
 # The version of Python used here should match the version of the Alpine
 # python3 package installed in the compile-stage.
-FROM docker.io/library/python:3.11.11-alpine3.19 AS build-stage
+FROM docker.io/library/python:3.12.8-alpine3.21 AS build-stage
 
 ###
 # For a list of pre-defined annotation keys and value types see:
@@ -93,8 +93,8 @@ ENV VIRTUAL_ENV="${CISA_HOME}/.venv"
 
 RUN apk --no-cache add \
   ca-certificates=20241121-r1 \
-  chromium=124.0.6367.78-r0 \
-  py3-lxml=4.9.3-r1
+  chromium=131.0.6778.264-r0 \
+  py3-lxml=5.3.0-r0
 
 # Create unprivileged user
 RUN addgroup --system --gid ${CISA_GID} ${CISA_GROUP} \

README.md

@@ -23,7 +23,7 @@ Python library. Then it will output CSVs with agency and domain level results.
 To run the `cisagov/vdp-scanner` image via Docker:
 
 ```console
-docker run cisagov/vdp-scanner:0.2.0-dev.5
+docker run cisagov/vdp-scanner:0.2.0-dev.6
 ```
 
 ### Running with Docker Compose ###
@@ -36,7 +36,7 @@ docker run cisagov/vdp-scanner:0.2.0-dev.5
 
     services:
       vdp-scanner:
-        image: cisagov/vdp-scanner:0.2.0-dev.5
+        image: cisagov/vdp-scanner:0.2.0-dev.6
         volumes:
           - .:/task/host_mount
     ```
@@ -74,7 +74,7 @@ docker run cisagov/vdp-scanner:0.2.0-dev.5
 1. Pull the new image:
 
     ```console
-    docker pull cisagov/vdp-scanner:0.2.0-dev.5
+    docker pull cisagov/vdp-scanner:0.2.0-dev.6
     ```
 
 1. Recreate and run the container by following the [previous instructions](#running-with-docker).
@@ -113,11 +113,11 @@ and then update dependencies as you would above.
 The images of this container are tagged with [semantic
 versions](https://semver.org) of the underlying example project that they
 containerize.  It is recommended that most users use a version tag (e.g.
-`:0.2.0-dev.5`).
+`:0.2.0-dev.6`).
 
 | Image:tag | Description |
 |-----------|-------------|
-|`cisagov/vdp-scanner:0.2.0-dev.5`| An exact release version. |
+|`cisagov/vdp-scanner:0.2.0-dev.6`| An exact release version. |
 |`cisagov/vdp-scanner:0.2`| The most recent release matching the major and minor version numbers. |
 |`cisagov/vdp-scanner:0`| The most recent release matching the major version number. |
 |`cisagov/vdp-scanner:edge` | The most recent image built from a merge into the `develop` branch of this repository. |
@@ -183,7 +183,7 @@ Build the image locally using this git repository as the [build context](https:/
 
 ```console
 docker build \
-  --tag cisagov/vdp-scanner:0.2.0-dev.5 \
+  --tag cisagov/vdp-scanner:0.2.0-dev.6 \
   https://github.com/cisagov/vdp-scanner-docker.git#develop
 ```
 
@@ -214,7 +214,7 @@ Docker:
       --file Dockerfile-x \
       --platform linux/amd64 \
       --output type=docker \
-      --tag cisagov/vdp-scanner:0.2.0-dev.5 .
+      --tag cisagov/vdp-scanner:0.2.0-dev.6 .
     ```
 
 ## Contributing ##

src/Pipfile

@@ -7,10 +7,10 @@ name = "pypi"
 docopt = "*"
 hash-http-content = {file = "https://github.com/cisagov/hash-http-content/archive/v0.1.0.tar.gz"}
 # We need to use the system package version of this package. This matches the version
-# available for Alpine Linux 3.19.
-lxml = "4.9.3"
+# available for Alpine Linux 3.21.
+lxml = "5.3.0"
 requests = "*"
 urllib3 = "*"
 
 [requires]
-python_full_version = "3.11.11"
+python_full_version = "3.12.8"