From b6dc581c2bc73ee1820a99958578ec7aa14e5bdf Mon Sep 17 00:00:00 2001
From: "sentry-junior[bot]"
 <264270552+sentry-junior[bot]@users.noreply.github.com>
Date: Tue, 27 Oct 2026 19:21:50 +0000
Subject: [PATCH] feat: Mirror python:3.14.10-slim-bookworm

Its ca-certificates (20250419~deb12u2) no longer trusts the compromised
eMudhra emSign ECC Root CA - G3. launchpad moves to it from
3.14.4-slim-bookworm instead of patching ca-certificates in its Dockerfile.

Refs VULN-3216

Co-Authored-By: Geoff Goldsmith <geoff.goldsmith@sentry.io>
---
 main.py | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/main.py b/main.py
index 985f78a..a832eeb 100644
--- a/main.py
+++ b/main.py
@@ -418,6 +418,15 @@ def update(self) -> Image:
             'sha256:fdc02ec63f6f10b14a31159fbccb15b7b85a990ec27d7bf120e725a70fb256d7',  # noqa: E501
         ),
     ),
+    Image(
+        registry='registry-1.docker.io',
+        source='library/python',
+        tag='3.14.10-slim-bookworm',
+        digests=(
+            'sha256:0a8fba2dab2d37bf67d3483206ad13acd6f6e15c30149819452135993ed604a6',  # noqa: E501
+            'sha256:192a819d0f605b219136b5f5f91174127d0f39a747844fa5ce71cbeaf913f662',  # noqa: E501
+        ),
+    ),
     Image(
         registry='registry-1.docker.io',
         source='library/python',