Maintenance releases for Meltano

[mrkmcnamee]

Hi,

The current Meltano release cycle does not propagate security updates in a timely fashion. Creating maintenance releases with security updates would solve this.

We use Dependabot to keep our repos up-to-date with the latest security updates. We also use AWS Inspector to scan for image vulnerabilities. In practice this means that we do regular (monthly) maintenance releases of our packages to maintain our SOC2 compliance. Doing monthly releases means that we are using the latest Python base image plus the latest Python packages in our deliverables.

Those images that we build using Python as a base image can expect the base image to be rerolled continuously as new patches become available. At the time of writing Python 3.14.4 had been pushed to Docker Hub 3 days ago.

We also use Meltano v4.2.0 as the base image for one of our packages (which is in turn based on the Python 3.14.4 base image). However, Meltano releases only seem to made when new functionality is being delivered. The Meltano v4.2.0 release is from April 11th.

The previous Meltano v4.1.2 was on February 3rd, meaning that it can be months between releases, which a long time before critical vulnerabilities in Python and other packages are addressed. There are two approaches to solving this problem:

• Re-roll the existing releases and pushing to Docker Hub in tandem with Python. No version change needed.
• Apply security updates (Dependabot?) to Meltano and do regular (monthly) maintenance releases.

Solutions in order of preference:

1. Re-roll + maintenance releases
2. Maintenance releases
3. Re-roll

Would be interested to hear other thoughts on this.

Cheers,
Kevin

[edgarrmondragon]

Thanks for starting the conversation @mrkmcnamee!

I'm open to both make more frequent maintenance releases and re-roll the latest release to Docker Hub.

I do hesitate to publish releases when PyPI metadata (i.e. runtime dependencies in pyproject.toml) nor runtime code has actually changed (Library dependency version specifiers aren't for fixing vulnerabilities).

Still, we could stabilize the Docker build process by installing from the dependencies locked in uv.lock. That way, we could justify triggering a re-publish to Docker Hub any time runtime dependencies are updated in the lockfile.

That said, I would have to investigate what's involved in overwriting existing tags in a way that doesn't publish new code to Docker Hub without also publishing to PyPI.

Wdyt?

[mrkmcnamee]

Hi @edgarrmondragon!

In our case maintenance releases occur often enough (monthly) that we don't have to consider re-rolling existing releases just to ensure the latest security updates are applied in a timely fashion. That being said, the workflow for re-rolling could be borrowed from Python itself perhaps?

The article you are referring to is about how keeping up-to-date with security updates by bumping dependency versions creates a snowball effect. This is a valid concern but is not an obstacle to staying secure. A maintenance release can still pull the latest compatible dependency version without the need to bump the dependency file to explicitly use it. So in the example, given "urllib3>=2", Dependabot would still create a PR with a security update, but it would only bump the version in poetry.lock, not pyproject.toml. In other words, the library dependency version specifiers are not modified and so compatibility is unaffected.

Something like this could be added to the Meltano dependabot.yml:

version: 2
updates:
  - package-ecosystem: "uv"
    directory: "/"
    schedule:
      interval: "weekly"
    groups:
      all-security-updates:
        applies-to: security-updates
        patterns:
          - "*"

Cheers,
Kevin

[edgarrmondragon]

#10018.

Thanks again @mrkmcnamee!

[mrkmcnamee]

Good morning @edgarrmondragon !

When will a re-rolled v4.2.0 become available on Docker Hub?

Cheers,
Kevin

[edgarrmondragon]

We had a false positive vuln report in a docs-only dependency preventing the Docker images from being pushed, I just re-triggered and the images have been re-rolled 🎉

https://hub.docker.com/r/meltano/meltano/tags

[mrkmcnamee]

Awesome. This worked. Much appreciated.

Cheers,
Kevin