backport security fixes

[antoinerg]

Closes https://github.com/plotly/dekn/issues/7363 by bringing the changes from #14

A bunch of my earlier PRs were merged upstream but no releases were made 😿

I decided to reuse the images I made for 5.3-sp which were tested to work. This is less error-prone considering this is late.

The only new PR to review in conjunction to this one is plotly/paketo-buildpacks_cpython#8

Components to upgrade:

• poetry-install
• poetry
• pipenv-install
• cpython merge upstream changes from v0.13.0 paketo-buildpacks_cpython#8
• pip
• pip-install
• conda-env-update

I built and pushed a new image:

./scripts/package.sh --version 5.4.0b2 --output quay.io/plotly/paketo-buildpacks-python:5.4.0b2
docker push quay.io/plotly/paketo-buildpacks-python:5.4.0b2

[antoinerg]

In 5e3c00d, we fixed an additional CVE thanks to a new upstream release!

[antoinerg]

I rebuilt the image with:

./scripts/package.sh --version 5.4.0 --output quay.io/plotly/paketo-buildpacks-python:5.4.0b3
docker push quay.io/plotly/paketo-buildpacks-python:5.4.0b3

[BRONSOLO]

@antoinerg should this be landing against main with the idea being we'd cut the 5.4 release branch when we freeze off of main?

[antoinerg]

@antoinerg should this be landing against main with the idea being we'd cut the 5.4 release branch when we freeze off of main?

I initially wanted to do that, but 5.4-release is ahead of main. See main...5.4-release

Unless you have any objection, we'll merge 5.4-release into main once everything is ready.

cc @BRONSOLO

[BRONSOLO]

Ah, interesting. @tarzzz @antoinerg sorry if this was already discussed by why the early branching for 5.4?

[tarzzz]

@BRONSOLO We exclusively use branches for buildpacks work so that it's easier to sync main with upstream.

There is documentation somewhere (i cant find) but the process to sync with upstream is:

1. Create a release branch from older release (5.3-release -> 5.4-release).
2. Sync main from upstream
3. Merge main onto release branch so that release branch has all the latest changes. For merge conflicts, be prefer our code over the upstream (because that has our custom fixes).

Hope that's helpful.

[antoinerg]

I think this one is ready for another round of review!

See https://github.com/plotly/dek-deployment/pull/3963 for test details!