GitHub user FrancescoCastaldi added a comment to the discussion: Setting the
version number in a custom build
The "0.0.0-dev" string comes from two places in Superset:
1. `superset-frontend/package.json` where the default npm package version is
set to `"0.0.0-dev"`.
2. `superset/config.py`, where `VERSION_STRING` is resolved by reading
`static/version_info.json` or falling back to `static/assets/package.json`.
When Trivy scans your custom image, it inspects Python package metadata
(`.dist-info/METADATA`) or `package.json`. If it detects `0.0.0-dev`, it treats
the build as an unreleased dev snapshot and flags all known CVEs.
Here is how to patch both the UI display and the package version in your
Dockerfile:
### 1. Patch `version_info.json` and `VERSION_STRING` in Dockerfile
In your Dockerfile, after installing your custom requirements, generate the
`static/version_info.json` file and set the build environment variables:
```dockerfile
ARG SUPERSET_VERSION=6.1.0
ARG COMMIT_SHA=abcdef12
# Write version_info.json read by superset/config.py
RUN python -c "import json; json.dump({'version': '${SUPERSET_VERSION}',
'GIT_SHA': '${COMMIT_SHA}'}, open('/app/superset/static/version_info.json',
'w'))"
# Patch frontend package.json if present
RUN if [ -f /app/superset/static/assets/package.json ]; then \
sed -i 's/"version": "0.0.0-dev"/"version": "'"${SUPERSET_VERSION}"'"/'
/app/superset/static/assets/package.json; \
fi
```
### 2. Override `VERSION_STRING` in `superset_config.py`
You can also set the version string explicitly in your `superset_config.py`
without touching container files:
```python
# In superset_config.py
import os
SUPERSET_VERSION = os.environ.get("SUPERSET_VERSION", "6.1.0")
COMMIT_SHA = os.environ.get("COMMIT_SHA", "custom")
VERSION_STRING = f"{SUPERSET_VERSION}-git.{COMMIT_SHA}"
BUILD_NUMBER = COMMIT_SHA
```
### 3. Ensure Python Package Metadata reflects the release (for Trivy)
If you install Superset from a local directory in editable mode (`pip install
-e .`), `setuptools_scm` generates `0.0.0.dev0` if git tags are missing. Pass
`SETUPTOOLS_SCM_PRETEND_VERSION` during build:
```dockerfile
ENV SETUPTOOLS_SCM_PRETEND_VERSION=${SUPERSET_VERSION}
```
This ensures Trivy recognizes the exact release version and avoids false
positive vulnerability alerts.
GitHub link:
https://github.com/apache/superset/discussions/41582#discussioncomment-19164786
----
This is an automatically sent email for [email protected].
To unsubscribe, please send an email to:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
