Conversation
Pratyush Ranjan (PratRanj07)
requested review from
a team and
Matthew Seal (MSeal)
as code owners
|
🎉 All Contributor License Agreements have been signed. Ready to merge. |
There was a problem hiding this comment.
Pull request overview
This PR prepares the codebase for the v2.13.2 release candidate (RC1) by updating version references in the Docker build configuration and CHANGELOG. The release appears to be a maintenance release that includes various bug fixes and enhancements as documented in the CHANGELOG.
Changes:
- Updated librdkafka version from v2.13.0 to v2.13.2-RC1 in the Alpine Dockerfile
- Updated CHANGELOG header from v2.13.1 to v2.13.2
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| examples/docker/Dockerfile.alpine | Updates the LIBRDKAFKA_VERSION environment variable to v2.13.2-RC1 to align with the new release candidate |
| CHANGELOG.md | Updates the version section header to v2.13.2 |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| ## v2.13.1 | ||
| ## v2.13.2 | ||
|
|
||
| v2.13.1 is a maintenance release with the following fixes and enhancements: |
There was a problem hiding this comment.
The version number in the description text should be updated to match the section header. The section is titled "v2.13.2" but the description still references "v2.13.1". This creates an inconsistency in the changelog.
| COPY . /usr/src/confluent-kafka-python | ||
|
|
||
| ENV LIBRDKAFKA_VERSION="v2.13.0" | ||
| ENV LIBRDKAFKA_VERSION="v2.13.2-RC1" |
There was a problem hiding this comment.
LIBRDKAFKA_VERSION is used to download and build librdkafka from GitHub via a curl ... | tar ... && ./configure && make install chain, but it is pinned only to a mutable tag and the download has no checksum or signature verification. If the upstream repository or release tag is compromised, attackers can inject arbitrary code into the Docker build and any containers built from this image. To reduce this supply chain risk, pin to an immutable commit SHA (or vendored source) and verify release hashes or signatures before building.
|
No description provided.