Update Docker base images from Python v3.12.10 to v3.12.13

[PeterDaveHello]

Use the current Python 3.12 security release for the container images while keeping them aligned with the runtime declared in pyproject.toml.

References:

• https://www.python.org/downloads/release/python-31213/
• https://hub.docker.com/_/python/tags?name=3.12.13-slim

GitHub Copilot PR Summary

This pull request updates the base Python version used in both the main and GitHub Action Dockerfiles to ensure consistency and to include the latest patches.

Dependency updates:

• Updated the base image in both Dockerfile.github_action and docker/Dockerfile from python:3.12.10-slim to python:3.12.13-slim to use the latest Python 3.12 patch release. [1] [2]

[qodo-free-for-open-source-projects]

Review Summary by Qodo

Update Docker base images from Python v3.12.10 to v3.12.13

✨ Enhancement

Walkthroughs

Description

• Update Python base image to v3.12.13 in both Dockerfiles
• Includes latest security patches for Python 3.12
• Maintains alignment with pyproject.toml runtime declaration

Diagram

flowchart LR
  old["Python 3.12.10-slim"]
  new["Python 3.12.13-slim"]
  dockerfiles["Dockerfile.github_action<br/>docker/Dockerfile"]
  old -- "security update" --> new
  new -- "applied to" --> dockerfiles

Loading

File Changes

1. Dockerfile.github_action Dependencies +1/-1

Update GitHub Action Dockerfile base image

• Updated base image from python:3.12.10-slim to python:3.12.13-slim
• Incorporates latest Python 3.12 security patches

Dockerfile.github_action

---

2. docker/Dockerfile Dependencies +1/-1

Update main Dockerfile base image

• Updated base image from python:3.12.10-slim to python:3.12.13-slim
• Incorporates latest Python 3.12 security patches

docker/Dockerfile

---

[qodo-free-for-open-source-projects]

Code Review by Qodo

🐞 Bugs (2) 📘 Rule violations (0)

1. Lambda version drift 🐞 Bug ≡ Correctness

Description

After this PR, the main and GitHub Action images use Python 3.12.13, but the Lambda image still
builds from public.ecr.aws/lambda/python:3.12, creating inconsistent runtimes across deployment
targets and leaving Lambda on an unspecified patch level.

Code

docker/Dockerfile[1]

+FROM python:3.12.13-slim AS base

Evidence

The PR updates the primary Docker build to Python 3.12.13-slim, but the Lambda Dockerfile still
references a 3.12 tag without a patch version, so different images produced by this repo will run
different patch levels of Python.

docker/Dockerfile[1-3]
Dockerfile.github_action[1-4]
docker/Dockerfile.lambda[1-2]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
The repo’s Docker images are no longer aligned on the same Python patch release: `docker/Dockerfile` and `Dockerfile.github_action` use `python:3.12.13-slim`, while `docker/Dockerfile.lambda` still uses `public.ecr.aws/lambda/python:3.12`.

### Issue Context
This creates runtime drift across deployment targets and may leave Lambda on an older patch level than the rest of the system.

### Fix Focus Areas
- docker/Dockerfile.lambda[1-1]
- docker/Dockerfile[1-1]
- Dockerfile.github_action[1-1]

### Suggested change
Update the Lambda base image to an explicit patch version (if the Lambda image supports it) or otherwise document/standardize the expected patch alignment so all produced images are consistent.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

2. Base image not digest-pinned 🐞 Bug ⛨ Security

Description

The updated FROM lines still use a mutable tag (python:3.12.13-slim) rather than an immutable
digest, so the base image can change over time without a code change, impacting reproducibility and
supply-chain stability.

Code

Dockerfile.github_action[1]

+FROM python:3.12.13-slim AS base

Evidence

The modified Dockerfiles reference the base image by tag only, and the repo contains no Dockerfiles
using digest-pinning (@sha256:), so builds remain dependent on whatever the tag points to at build
time.

Dockerfile.github_action[1-3]
docker/Dockerfile[1-3]
docker/Dockerfile.lambda[1-2]
Best Practice: Docker base image digest pinning

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
The Dockerfiles use tag-only `FROM` references, which are mutable over time and can change without a code change.

### Issue Context
This is a pre-existing pattern in the repo; since this PR is already changing the `FROM` lines, it’s a convenient place to optionally introduce digest pinning.

### Fix Focus Areas
- Dockerfile.github_action[1-1]
- docker/Dockerfile[1-1]

### Suggested change
Replace `FROM python:3.12.13-slim` with `FROM python:3.12.13-slim@sha256:<digest>` (and keep a comment or automation to update the digest alongside version bumps).

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

[anhtu97]

Preparing PR description...

[anhtu97]

Preparing PR description...

[anhtu97]

Preparing PR description...

[anhtu97]

Preparing PR description...

[anhtu97]

Preparing PR description...

[anhtu97]

Preparing PR description...

[anhtu97]

Preparing PR description...

[anhtu97]

Preparing PR description...

[anhtu97]

Preparing PR description...

[anhtu97]

Preparing PR description...

[anhtu97]

Preparing PR description...

[anhtu97]

Preparing PR description...

[anhtu97]

Preparing PR description...

[anhtu97]

Preparing PR description...