chore: bump SDM base image to python-connector-base 4.1.1

[Anatolii Yatsuk (tolik0)]

What

Bumps the python-connector-base pin in the root Dockerfile from 4.1.0 to 4.1.1.

-FROM docker.io/airbyte/python-connector-base:4.1.0@sha256:1d1aa21d34e851df4e8a87b391c27724c06e2597608e7161f4d167be853bd7b6
+FROM docker.io/airbyte/python-connector-base:4.1.1@sha256:a268b44c733ae699a60f5fbc06a324945dba98945c6e2ab7f8609f2f895b0d28

4.1.1 was released 2026-07-22 in airbytehq/airbyte#80337 (Python 3.13.9-slim-bookworm → 3.13.14-slim-bookworm). The SDM pin has been on 4.1.0 since 2025-10-23 (#805), so SDM has not picked it up — source-declarative-manifest:7.28.3, published 2026-08-28, still carries the 4.1.0 package set.

Why

Three critical OS CVEs are currently open against SDM-rooted connectors and are fixed by this bump. Package versions below were read out of the published images with crane export (var/lib/dpkg/status), and required versions come from the Debian security tracker.

Oncall issue	CVE	Package	SDM 7.28.3 today	Fix requires	base 4.1.1
#11792	CVE-2025-14087	libglib2.0-0	2.74.6-2+deb12u7	deb12u8	2.74.6-2+deb12u9 ✅
#11793	CVE-2026-2781	libnss3	2:3.87.1-1+deb12u1	deb12u2 (DSA-6149-1)	2:3.87.1-1+deb12u3 ✅
#12959	CVE-2026-45447	libssl3 / openssl	3.0.17-1~deb12u3	3.0.20-1~deb12u2	3.0.20-1~deb12u2 ✅

Also picks up libxml2 deb12u4 → deb12u6 and poppler-utils deb12u1 → deb12u2, and drops the vulnerable virtualenv/seed/wheels/embed/wheel-*.whl (GHSA-8rrh-rw8j-w5fx).

Blast radius: 512 of the 655 connectors in the OSS registry are SDM-rooted, so this is the single highest-leverage change for these three CVEs.

What this does not fix

• setuptools stays at 78.1.1 in the base image, below the 83.0.0 that CVE-2026-59890 needs (#13315). That needs a new base image release plus widening setuptools = "^80.9.0" in pyproject.toml.
• nltk 3.9.1 (#11795, needs 3.9.3) and unstructured 0.10.27 (#11267, needs 0.18.18) are CDK Python dependencies, untouched here.

Notes for the reviewer

• Per docs/RELEASES.md (added in docs: link SDM release guide to the internal base image runbook #1140), merging this publishes nothing — the new SDM image only ships with the next CDK release.
• Upgrade to airbyte/python-connector-base 4.0.0 in Dockerfile #327 warned that a base image bump should be treated as breaking, since Cloud connections auto-update to the new base. That was written for the 3.9 → 3.11 jump; this one is a Python patch bump (3.13.9 → 3.13.14) plus Debian security patches, so a major CDK bump is likely unnecessary — but worth a second opinion from whoever owns the connector base images runbook.
• The digest is the multi-arch OCI index digest (linux/amd64 + linux/arm64), matching the convention of the existing pin.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Updated the application’s container base image to the latest 4.1.1 release for improved maintenance and reliability.

[github-actions]

👋 Greetings, Airbyte Team Member!

Here are some helpful tips and reminders for your convenience.

💡 Show Tips and Tricks

Testing This CDK Version

You can test this version of the CDK using the following:

# Run the CLI from this branch:
uvx 'git+https://github.com/airbytehq/airbyte-python-cdk.git@chore/sdm-base-image-4-1-1#egg=airbyte-python-cdk[dev]' --help

# Update a connector to use the CDK from this branch ref:
cd airbyte-integrations/connectors/source-example
poe use-cdk-branch chore/sdm-base-image-4-1-1

PR Slash Commands

Airbyte Maintainers can execute the following slash commands on your PR:

• /autofix - Fixes most formatting and linting issues
• /poetry-lock - Updates poetry.lock file
• /test - Runs connector tests with the updated CDK
• /prerelease - Triggers a prerelease publish with default arguments
• /poe build - Regenerate git-committed build artifacts, such as the pydantic models which are generated from the manifest JSON schema in YAML.
• /poe <command> - Runs any poe command in the CDK environment

📚 Show Repo Guidance

Helpful Resources

• CDK API Reference

📝 Edit this welcome message.

[Copilot]

Pull request overview

Bumps the airbyte/source-declarative-manifest build base image pin in the root Dockerfile from docker.io/airbyte/python-connector-base:4.1.0 to 4.1.1 (including updating the pinned OCI digest), aligning SDM builds with the newer connector base that includes updated Debian security patches and a Python 3.13 patch-level update.

Changes:

• Update the python-connector-base image tag from 4.1.0 to 4.1.1.
• Update the pinned sha256 digest to match the new multi-arch OCI index.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

PyTest Results (Fast)

4 363 tests  ±0   4 351 ✅ ±0   9m 20s ⏱️ -27s
    1 suites ±0      12 💤 ±0 
    1 files   ±0       0 ❌ ±0 

Results for commit 6c1d801. ± Comparison against base commit 64bdfc9.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Team

Run ID: ea56d4db-83dd-412d-8d9d-705695ff99a2

📥 Commits

Reviewing files that changed from the base of the PR and between 64bdfc9 and 6c1d801.

📒 Files selected for processing (1)

• Dockerfile

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The Dockerfile now uses python-connector-base:4.1.1 with its updated pinned SHA256 digest.

Changes

Docker Base Image Upgrade

Layer / File(s)	Summary
Update Docker base image Dockerfile	The base image tag and pinned SHA256 digest change from version 4.1.0 to 4.1.1.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to 6c1d8

This localized change updates the connector base image to a newer pinned patch release; no actionable merge-blocking risk remains beyond normal checks and review.

Suggested reviewers: bazarnov

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: updating the SDM Docker base image to python-connector-base 4.1.1.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/sdm-base-image-4-1-1

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}