Repository navigation
Releases
3.13.18-dev-20261110.7
ghcr.io/pair-ai-platform/python:3.13.18-dev-20261110.7
Python 3.13.18 (dev). Index digest sha256:cc3aa9bf6f2b4da7816e08c61bba6e8fcb437e714423cdaf613cc8c42c007947.
Tags: 3.13.18-dev-20261110.7, 3.13-dev, 3.13.18-dev.
What changed
First release of this image.
SBOM and size
| Architecture | Packages (SBOM) | Compressed | Installed |
|---|---|---|---|
| x86_64 | 78 | 238.0 MB | 238.0 MB |
| aarch64 | 78 | 223.0 MB | 681.0 MB |
Main components: binutils 2.47-r4, ca-certificates-bundle 20261020-r0, gcc 16.2.0-r3, git 2.56.0-r3, glibc-2.44 2.44-r16, glibc-2.44-dev 2.44-r16, libffi 3.8.0-r2, libffi-dev 3.8.0-r2, libstdc++ 16.2.0-r3, libstdc++-dev 16.2.0-r3, make 4.4.1-r15, openssl-4.0-dev 4.0.3-r8, openssl-4.0-libcrypto 4.0.3-r8, openssl-4.0-libssl 4.0.3-r8, py3-pip-wheel 26.2.2-r2, python-3.13 3.13.18_git20261030-r0, python-3.13-base 3.13.18_git20261030-r0, python-3.13-base-dev 3.13.18_git20261030-r0, python-3.13-dev 3.13.18_git20261030-r0, sqlite-libs 3.54.1-r0.
The SPDX SBOMs are attached to this release and to each image as signed attestations.
Scans
| Architecture | Hardening profile, DISA GPOS SRG (applicable rules passed) | Not applicable | Vulnerabilities (C / H / M / L) |
|---|---|---|---|
| x86_64 | 85 / 91 (93.4%) | 107 | 0 / 2 / 2 / 1 |
| aarch64 | 85 / 91 (93.4%) | 107 | 0 / 2 / 2 / 1 |
Vulnerabilities
| ID | Severity | Package | Installed | Comes from | Fixed upstream in | Architectures |
|---|---|---|---|---|---|---|
| CVE-2026-119586 | High | sqlite-libs |
3.54.1-r0 | sqlite-libs 3.54.1-r0 |
no fix yet | x86_64, aarch64 |
| CVE-2026-84243 | High | glibc-2.44 |
2.44-r16 | glibc-2.44 2.44-r16 |
no fix yet | x86_64, aarch64 |
| CVE-2025-15367 | Medium | python-3.13 |
3.13.18_git20261030-r0 | python-3.13 3.13.18_git20261030-r0 |
no fix yet | x86_64, aarch64 |
| CVE-2026-116566 | Medium | python-3.13 |
3.13.18_git20261030-r0 | python-3.13 3.13.18_git20261030-r0 |
no fix yet | x86_64, aarch64 |
| CVE-2026-103995 | Low | python-3.13 |
3.13.18_git20261030-r0 | python-3.13 3.13.18_git20261030-r0 |
no fix yet | x86_64, aarch64 |
Comes from is the Wolfi package that brings the affected code into the image; a library bundled inside the toolchain, for example, comes from that package. Fixed upstream in is the version of the affected code that fixes it; the image gets the fix when the package it comes from ships that version, and the next build after that publishes it.
Hardening-profile rules not passed (x86_64):
SV-203649r971535_rule: The operating system must use mechanisms meeting the requirements of applicable federal laws, Executive orders, directives, policies, regulations, standards, and guidance for authentication to a cryptographic module.SV-203739r987791_rule: The operating system must implement NSA-approved cryptography to protect classified information in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.SV-203750r958912_rule: The operating system must maintain the confidentiality and integrity of information during preparation for transmission.SV-203751r958914_rule: The operating system must maintain the confidentiality and integrity of information during reception.SV-203776r959006_rule: The operating system must implement NIST FIPS-validated cryptography for the following: to provision digital signatures, to generate cryptographic hashes, and to protect unclassified information requiring confidentiality and cryptographic protection in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.SV-263659r982563_rule: The operating system must include only approved trust anchors in trust stores or certificate stores managed by the organization.
Verify
cosign verify ghcr.io/pair-ai-platform/python:3.13.18-dev-20261110.7 \
--certificate-identity-regexp '^https://github.com/Pair-AI-Platform/python/.github/workflows/build.yml@' \
--certificate-oidc-issuer https://token.actions.githubusercontent.com
gh attestation verify oci://ghcr.io/pair-ai-platform/python:3.13.18-dev-20261110.7 --repo Pair-AI-Platform/python3.13.18-20261110.7
ghcr.io/pair-ai-platform/python:3.13.18-20261110.7
Python 3.13.18 (runtime). Index digest sha256:5321a86d3229ce301d11f2c2ab5543dd8860ac9631178ce6bebff120211f00a4.
Tags: 3.13.18-20261110.7, 3.13, 3.13.18.
What changed
First release of this image.
SBOM and size
| Architecture | Packages (SBOM) | Compressed | Installed |
|---|---|---|---|
| x86_64 | 36 | 31.7 MB | 31.7 MB |
| aarch64 | 36 | 30.1 MB | 82.5 MB |
Main components: ca-certificates-bundle 20261020-r0, glibc-2.44 2.44-r16, libffi 3.8.0-r2, libstdc++ 16.2.0-r3, openssl-4.0-libcrypto 4.0.3-r8, openssl-4.0-libssl 4.0.3-r8, py3-pip-wheel 26.2.2-r2, python-3.13 3.13.18_git20261030-r0, python-3.13-base 3.13.18_git20261030-r0, sqlite-libs 3.54.1-r0.
The SPDX SBOMs are attached to this release and to each image as signed attestations.
Scans
| Architecture | Hardening profile, DISA GPOS SRG (applicable rules passed) | Not applicable | Vulnerabilities (C / H / M / L) |
|---|---|---|---|
| x86_64 | 85 / 91 (93.4%) | 107 | 0 / 2 / 2 / 1 |
| aarch64 | 85 / 91 (93.4%) | 107 | 0 / 2 / 2 / 1 |
Vulnerabilities
| ID | Severity | Package | Installed | Comes from | Fixed upstream in | Architectures |
|---|---|---|---|---|---|---|
| CVE-2026-119586 | High | sqlite-libs |
3.54.1-r0 | sqlite-libs 3.54.1-r0 |
no fix yet | x86_64, aarch64 |
| CVE-2026-84243 | High | glibc-2.44 |
2.44-r16 | glibc-2.44 2.44-r16 |
no fix yet | x86_64, aarch64 |
| CVE-2025-15367 | Medium | python-3.13 |
3.13.18_git20261030-r0 | python-3.13 3.13.18_git20261030-r0 |
no fix yet | x86_64, aarch64 |
| CVE-2026-116566 | Medium | python-3.13 |
3.13.18_git20261030-r0 | python-3.13 3.13.18_git20261030-r0 |
no fix yet | x86_64, aarch64 |
| CVE-2026-103995 | Low | python-3.13 |
3.13.18_git20261030-r0 | python-3.13 3.13.18_git20261030-r0 |
no fix yet | x86_64, aarch64 |
Comes from is the Wolfi package that brings the affected code into the image; a library bundled inside the toolchain, for example, comes from that package. Fixed upstream in is the version of the affected code that fixes it; the image gets the fix when the package it comes from ships that version, and the next build after that publishes it.
Hardening-profile rules not passed (x86_64):
SV-203649r971535_rule: The operating system must use mechanisms meeting the requirements of applicable federal laws, Executive orders, directives, policies, regulations, standards, and guidance for authentication to a cryptographic module.SV-203739r987791_rule: The operating system must implement NSA-approved cryptography to protect classified information in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.SV-203750r958912_rule: The operating system must maintain the confidentiality and integrity of information during preparation for transmission.SV-203751r958914_rule: The operating system must maintain the confidentiality and integrity of information during reception.SV-203776r959006_rule: The operating system must implement NIST FIPS-validated cryptography for the following: to provision digital signatures, to generate cryptographic hashes, and to protect unclassified information requiring confidentiality and cryptographic protection in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.SV-263659r982563_rule: The operating system must include only approved trust anchors in trust stores or certificate stores managed by the organization.
Verify
cosign verify ghcr.io/pair-ai-platform/python:3.13.18-20261110.7 \
--certificate-identity-regexp '^https://github.com/Pair-AI-Platform/python/.github/workflows/build.yml@' \
--certificate-oidc-issuer https://token.actions.githubusercontent.com
gh attestation verify oci://ghcr.io/pair-ai-platform/python:3.13.18-20261110.7 --repo Pair-AI-Platform/python3.12.16-dev-20261110.7
ghcr.io/pair-ai-platform/python:3.12.16-dev-20261110.7
Python 3.12.16 (dev). Index digest sha256:74bc5beb45c512107661b053ba0295beefefc175e54694ff4320f877380737a1.
Tags: 3.12.16-dev-20261110.7, 3.12-dev, 3.12.16-dev, latest-dev.
What changed
First release of this image.
SBOM and size
| Architecture | Packages (SBOM) | Compressed | Installed |
|---|---|---|---|
| x86_64 | 79 | 249.6 MB | 249.6 MB |
| aarch64 | 79 | 234.4 MB | 716.9 MB |
Main components: binutils 2.47-r4, ca-certificates-bundle 20261020-r0, gcc 16.2.0-r3, git 2.56.0-r3, glibc-2.44 2.44-r16, glibc-2.44-dev 2.44-r16, libffi 3.8.0-r2, libffi-dev 3.8.0-r2, libstdc++ 16.2.0-r3, libstdc++-dev 16.2.0-r3, make 4.4.1-r15, openssl-4.0-dev 4.0.3-r8, openssl-4.0-libcrypto 4.0.3-r8, openssl-4.0-libssl 4.0.3-r8, py3-pip-wheel 26.2.2-r2, python-3.12 3.12.16_git20261030-r0, python-3.12-base 3.12.16_git20261030-r0, python-3.12-base-dev 3.12.16_git20261030-r0, python-3.12-dev 3.12.16_git20261030-r0, python-3.13-base 3.13.18_git20261030-r0, sqlite-libs 3.54.1-r0.
The SPDX SBOMs are attached to this release and to each image as signed attestations.
Scans
| Architecture | Hardening profile, DISA GPOS SRG (applicable rules passed) | Not applicable | Vulnerabilities (C / H / M / L) |
|---|---|---|---|
| x86_64 | 85 / 91 (93.4%) | 107 | 0 / 2 / 1 / 1 |
| aarch64 | 85 / 91 (93.4%) | 107 | 0 / 2 / 1 / 1 |
Vulnerabilities
| ID | Severity | Package | Installed | Comes from | Fixed upstream in | Architectures |
|---|---|---|---|---|---|---|
| CVE-2026-119586 | High | sqlite-libs |
3.54.1-r0 | sqlite-libs 3.54.1-r0 |
no fix yet | x86_64, aarch64 |
| CVE-2026-84243 | High | glibc-2.44 |
2.44-r16 | glibc-2.44 2.44-r16 |
no fix yet | x86_64, aarch64 |
| CVE-2026-116566 | Medium | python-3.12 |
3.12.16_git20261030-r0 | python-3.12 3.12.16_git20261030-r0 |
no fix yet | x86_64, aarch64 |
| CVE-2026-103995 | Low | python-3.12 |
3.12.16_git20261030-r0 | python-3.12 3.12.16_git20261030-r0 |
no fix yet | x86_64, aarch64 |
Comes from is the Wolfi package that brings the affected code into the image; a library bundled inside the toolchain, for example, comes from that package. Fixed upstream in is the version of the affected code that fixes it; the image gets the fix when the package it comes from ships that version, and the next build after that publishes it.
Hardening-profile rules not passed (x86_64):
SV-203649r971535_rule: The operating system must use mechanisms meeting the requirements of applicable federal laws, Executive orders, directives, policies, regulations, standards, and guidance for authentication to a cryptographic module.SV-203739r987791_rule: The operating system must implement NSA-approved cryptography to protect classified information in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.SV-203750r958912_rule: The operating system must maintain the confidentiality and integrity of information during preparation for transmission.SV-203751r958914_rule: The operating system must maintain the confidentiality and integrity of information during reception.SV-203776r959006_rule: The operating system must implement NIST FIPS-validated cryptography for the following: to provision digital signatures, to generate cryptographic hashes, and to protect unclassified information requiring confidentiality and cryptographic protection in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.SV-263659r982563_rule: The operating system must include only approved trust anchors in trust stores or certificate stores managed by the organization.
Verify
cosign verify ghcr.io/pair-ai-platform/python:3.12.16-dev-20261110.7 \
--certificate-identity-regexp '^https://github.com/Pair-AI-Platform/python/.github/workflows/build.yml@' \
--certificate-oidc-issuer https://token.actions.githubusercontent.com
gh attestation verify oci://ghcr.io/pair-ai-platform/python:3.12.16-dev-20261110.7 --repo Pair-AI-Platform/python3.12.16-20261110.7
ghcr.io/pair-ai-platform/python:3.12.16-20261110.7
Python 3.12.16 (runtime). Index digest sha256:1db59351fd4f08f1879454e300f04cc02db57dcae63177c9e127eb91cfd5729a.
Tags: 3.12.16-20261110.7, 3.12, 3.12.16, latest.
What changed
First release of this image.
SBOM and size
| Architecture | Packages (SBOM) | Compressed | Installed |
|---|---|---|---|
| x86_64 | 37 | 43.4 MB | 43.4 MB |
| aarch64 | 37 | 41.6 MB | 118.9 MB |
Main components: ca-certificates-bundle 20261020-r0, glibc-2.44 2.44-r16, libffi 3.8.0-r2, libstdc++ 16.2.0-r3, openssl-4.0-libcrypto 4.0.3-r8, openssl-4.0-libssl 4.0.3-r8, py3-pip-wheel 26.2.2-r2, python-3.12 3.12.16_git20261030-r0, python-3.12-base 3.12.16_git20261030-r0, python-3.13-base 3.13.18_git20261030-r0, sqlite-libs 3.54.1-r0.
The SPDX SBOMs are attached to this release and to each image as signed attestations.
Scans
| Architecture | Hardening profile, DISA GPOS SRG (applicable rules passed) | Not applicable | Vulnerabilities (C / H / M / L) |
|---|---|---|---|
| x86_64 | 85 / 91 (93.4%) | 107 | 0 / 2 / 1 / 1 |
| aarch64 | 85 / 91 (93.4%) | 107 | 0 / 2 / 1 / 1 |
Vulnerabilities
| ID | Severity | Package | Installed | Comes from | Fixed upstream in | Architectures |
|---|---|---|---|---|---|---|
| CVE-2026-119586 | High | sqlite-libs |
3.54.1-r0 | sqlite-libs 3.54.1-r0 |
no fix yet | x86_64, aarch64 |
| CVE-2026-84243 | High | glibc-2.44 |
2.44-r16 | glibc-2.44 2.44-r16 |
no fix yet | x86_64, aarch64 |
| CVE-2026-116566 | Medium | python-3.12 |
3.12.16_git20261030-r0 | python-3.12 3.12.16_git20261030-r0 |
no fix yet | x86_64, aarch64 |
| CVE-2026-103995 | Low | python-3.12 |
3.12.16_git20261030-r0 | python-3.12 3.12.16_git20261030-r0 |
no fix yet | x86_64, aarch64 |
Comes from is the Wolfi package that brings the affected code into the image; a library bundled inside the toolchain, for example, comes from that package. Fixed upstream in is the version of the affected code that fixes it; the image gets the fix when the package it comes from ships that version, and the next build after that publishes it.
Hardening-profile rules not passed (x86_64):
SV-203649r971535_rule: The operating system must use mechanisms meeting the requirements of applicable federal laws, Executive orders, directives, policies, regulations, standards, and guidance for authentication to a cryptographic module.SV-203739r987791_rule: The operating system must implement NSA-approved cryptography to protect classified information in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.SV-203750r958912_rule: The operating system must maintain the confidentiality and integrity of information during preparation for transmission.SV-203751r958914_rule: The operating system must maintain the confidentiality and integrity of information during reception.SV-203776r959006_rule: The operating system must implement NIST FIPS-validated cryptography for the following: to provision digital signatures, to generate cryptographic hashes, and to protect unclassified information requiring confidentiality and cryptographic protection in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.SV-263659r982563_rule: The operating system must include only approved trust anchors in trust stores or certificate stores managed by the organization.
Verify
cosign verify ghcr.io/pair-ai-platform/python:3.12.16-20261110.7 \
--certificate-identity-regexp '^https://github.com/Pair-AI-Platform/python/.github/workflows/build.yml@' \
--certificate-oidc-issuer https://token.actions.githubusercontent.com
gh attestation verify oci://ghcr.io/pair-ai-platform/python:3.12.16-20261110.7 --repo Pair-AI-Platform/python3.11.18-dev-20261110.8
ghcr.io/pair-ai-platform/python:3.11.18-dev-20261110.8
Python 3.11.18 (dev). Index digest sha256:724d03c70fccfeb09146d137733ead98f7d1d64c5da39f4330431ae236832942.
Tags: 3.11.18-dev-20261110.8, 3.11-dev, 3.11.18-dev.
What changed
No package changed; the image metadata did.
SBOM and size
| Architecture | Packages (SBOM) | Compressed | Installed |
|---|---|---|---|
| x86_64 | 79 | 305.7 MB | 305.7 MB |
| aarch64 | 79 | 288.9 MB | 831.6 MB |
Main components: binutils 2.47-r4, ca-certificates-bundle 20261020-r0, gcc 16.2.0-r3, git 2.56.0-r3, glibc-2.44 2.44-r16, glibc-2.44-dev 2.44-r16, libffi 3.8.0-r2, libffi-dev 3.8.0-r2, libstdc++ 16.2.0-r3, libstdc++-dev 16.2.0-r3, make 4.4.1-r15, openssl-3.6-libcrypto 3.6.5-r6, openssl-3.6-libssl 3.6.5-r6, openssl-4.0-dev 4.0.3-r8, openssl-4.0-libcrypto 4.0.3-r8, openssl-4.0-libssl 4.0.3-r8, py3-pip-wheel 26.2.2-r2, python-3.11-upstream 3.11.18-r0, python-3.11-upstream-dev 3.11.18-r0, python-3.13-base 3.13.18_git20261030-r0, sqlite-libs 3.54.1-r0.
The SPDX SBOMs are attached to this release and to each image as signed attestations.
Scans
| Architecture | Hardening profile, DISA GPOS SRG (applicable rules passed) | Not applicable | Vulnerabilities (C / H / M / L) |
|---|---|---|---|
| x86_64 | 85 / 91 (93.4%) | 107 | 0 / 2 / 0 / 0 |
| aarch64 | 85 / 91 (93.4%) | 107 | 0 / 2 / 0 / 0 |
Vulnerabilities
| ID | Severity | Package | Installed | Comes from | Fixed upstream in | Architectures |
|---|---|---|---|---|---|---|
| CVE-2026-119586 | High | sqlite-libs |
3.54.1-r0 | sqlite-libs 3.54.1-r0 |
no fix yet | x86_64, aarch64 |
| CVE-2026-84243 | High | glibc-2.44 |
2.44-r16 | glibc-2.44 2.44-r16 |
no fix yet | x86_64, aarch64 |
Comes from is the Wolfi package that brings the affected code into the image; a library bundled inside the toolchain, for example, comes from that package. Fixed upstream in is the version of the affected code that fixes it; the image gets the fix when the package it comes from ships that version, and the next build after that publishes it.
Hardening-profile rules not passed (x86_64):
SV-203649r971535_rule: The operating system must use mechanisms meeting the requirements of applicable federal laws, Executive orders, directives, policies, regulations, standards, and guidance for authentication to a cryptographic module.SV-203739r987791_rule: The operating system must implement NSA-approved cryptography to protect classified information in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.SV-203750r958912_rule: The operating system must maintain the confidentiality and integrity of information during preparation for transmission.SV-203751r958914_rule: The operating system must maintain the confidentiality and integrity of information during reception.SV-203776r959006_rule: The operating system must implement NIST FIPS-validated cryptography for the following: to provision digital signatures, to generate cryptographic hashes, and to protect unclassified information requiring confidentiality and cryptographic protection in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.SV-263659r982563_rule: The operating system must include only approved trust anchors in trust stores or certificate stores managed by the organization.
Verify
cosign verify ghcr.io/pair-ai-platform/python:3.11.18-dev-20261110.8 \
--certificate-identity-regexp '^https://github.com/Pair-AI-Platform/python/.github/workflows/build.yml@' \
--certificate-oidc-issuer https://token.actions.githubusercontent.com
gh attestation verify oci://ghcr.io/pair-ai-platform/python:3.11.18-dev-20261110.8 --repo Pair-AI-Platform/python3.11.18-dev-20261110.7
ghcr.io/pair-ai-platform/python:3.11.18-dev-20261110.7
Python 3.11.18 (dev). Index digest sha256:3ba01b551f28fbf3e6f224c70ca09e78685b40807cda155f9bc23c194ae741f7.
Tags: 3.11.18-dev-20261110.7, 3.11-dev, 3.11.18-dev.
What changed
First release of this image.
SBOM and size
| Architecture | Packages (SBOM) | Compressed | Installed |
|---|---|---|---|
| x86_64 | 79 | 305.6 MB | 305.6 MB |
| aarch64 | 79 | 288.8 MB | 831.6 MB |
Main components: binutils 2.47-r4, ca-certificates-bundle 20261020-r0, gcc 16.2.0-r3, git 2.56.0-r3, glibc-2.44 2.44-r16, glibc-2.44-dev 2.44-r16, libffi 3.8.0-r2, libffi-dev 3.8.0-r2, libstdc++ 16.2.0-r3, libstdc++-dev 16.2.0-r3, make 4.4.1-r15, openssl-3.6-libcrypto 3.6.5-r6, openssl-3.6-libssl 3.6.5-r6, openssl-4.0-dev 4.0.3-r8, openssl-4.0-libcrypto 4.0.3-r8, openssl-4.0-libssl 4.0.3-r8, py3-pip-wheel 26.2.2-r2, python-3.11-upstream 3.11.18-r0, python-3.11-upstream-dev 3.11.18-r0, python-3.13-base 3.13.18_git20261030-r0, sqlite-libs 3.54.1-r0.
The SPDX SBOMs are attached to this release and to each image as signed attestations.
Scans
| Architecture | Hardening profile, DISA GPOS SRG (applicable rules passed) | Not applicable | Vulnerabilities (C / H / M / L) |
|---|---|---|---|
| x86_64 | 85 / 91 (93.4%) | 107 | 0 / 2 / 0 / 0 |
| aarch64 | 85 / 91 (93.4%) | 107 | 0 / 2 / 0 / 0 |
Vulnerabilities
| ID | Severity | Package | Installed | Comes from | Fixed upstream in | Architectures |
|---|---|---|---|---|---|---|
| CVE-2026-119586 | High | sqlite-libs |
3.54.1-r0 | sqlite-libs 3.54.1-r0 |
no fix yet | x86_64, aarch64 |
| CVE-2026-84243 | High | glibc-2.44 |
2.44-r16 | glibc-2.44 2.44-r16 |
no fix yet | x86_64, aarch64 |
Comes from is the Wolfi package that brings the affected code into the image; a library bundled inside the toolchain, for example, comes from that package. Fixed upstream in is the version of the affected code that fixes it; the image gets the fix when the package it comes from ships that version, and the next build after that publishes it.
Hardening-profile rules not passed (x86_64):
SV-203649r971535_rule: The operating system must use mechanisms meeting the requirements of applicable federal laws, Executive orders, directives, policies, regulations, standards, and guidance for authentication to a cryptographic module.SV-203739r987791_rule: The operating system must implement NSA-approved cryptography to protect classified information in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.SV-203750r958912_rule: The operating system must maintain the confidentiality and integrity of information during preparation for transmission.SV-203751r958914_rule: The operating system must maintain the confidentiality and integrity of information during reception.SV-203776r959006_rule: The operating system must implement NIST FIPS-validated cryptography for the following: to provision digital signatures, to generate cryptographic hashes, and to protect unclassified information requiring confidentiality and cryptographic protection in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.SV-263659r982563_rule: The operating system must include only approved trust anchors in trust stores or certificate stores managed by the organization.
Verify
cosign verify ghcr.io/pair-ai-platform/python:3.11.18-dev-20261110.7 \
--certificate-identity-regexp '^https://github.com/Pair-AI-Platform/python/.github/workflows/build.yml@' \
--certificate-oidc-issuer https://token.actions.githubusercontent.com
gh attestation verify oci://ghcr.io/pair-ai-platform/python:3.11.18-dev-20261110.7 --repo Pair-AI-Platform/python3.11.18-20261110.8
ghcr.io/pair-ai-platform/python:3.11.18-20261110.8
Python 3.11.18 (runtime). Index digest sha256:21c9e68ee0a85eae05845d8d4ae04446d9194129ff842242fb567dee7bc2f116.
Tags: 3.11.18-20261110.8, 3.11, 3.11.18.
What changed
No package changed; the image metadata did.
SBOM and size
| Architecture | Packages (SBOM) | Compressed | Installed |
|---|---|---|---|
| x86_64 | 38 | 58.6 MB | 58.6 MB |
| aarch64 | 38 | 55.4 MB | 147.7 MB |
Main components: ca-certificates-bundle 20261020-r0, glibc-2.44 2.44-r16, libffi 3.8.0-r2, libstdc++ 16.2.0-r3, openssl-3.6-libcrypto 3.6.5-r6, openssl-3.6-libssl 3.6.5-r6, openssl-4.0-libcrypto 4.0.3-r8, openssl-4.0-libssl 4.0.3-r8, py3-pip-wheel 26.2.2-r2, python-3.11-upstream 3.11.18-r0, python-3.13-base 3.13.18_git20261030-r0, sqlite-libs 3.54.1-r0.
The SPDX SBOMs are attached to this release and to each image as signed attestations.
Scans
| Architecture | Hardening profile, DISA GPOS SRG (applicable rules passed) | Not applicable | Vulnerabilities (C / H / M / L) |
|---|---|---|---|
| x86_64 | 85 / 91 (93.4%) | 107 | 0 / 2 / 0 / 0 |
| aarch64 | 85 / 91 (93.4%) | 107 | 0 / 2 / 0 / 0 |
Vulnerabilities
| ID | Severity | Package | Installed | Comes from | Fixed upstream in | Architectures |
|---|---|---|---|---|---|---|
| CVE-2026-119586 | High | sqlite-libs |
3.54.1-r0 | sqlite-libs 3.54.1-r0 |
no fix yet | x86_64, aarch64 |
| CVE-2026-84243 | High | glibc-2.44 |
2.44-r16 | glibc-2.44 2.44-r16 |
no fix yet | x86_64, aarch64 |
Comes from is the Wolfi package that brings the affected code into the image; a library bundled inside the toolchain, for example, comes from that package. Fixed upstream in is the version of the affected code that fixes it; the image gets the fix when the package it comes from ships that version, and the next build after that publishes it.
Hardening-profile rules not passed (x86_64):
SV-203649r971535_rule: The operating system must use mechanisms meeting the requirements of applicable federal laws, Executive orders, directives, policies, regulations, standards, and guidance for authentication to a cryptographic module.SV-203739r987791_rule: The operating system must implement NSA-approved cryptography to protect classified information in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.SV-203750r958912_rule: The operating system must maintain the confidentiality and integrity of information during preparation for transmission.SV-203751r958914_rule: The operating system must maintain the confidentiality and integrity of information during reception.SV-203776r959006_rule: The operating system must implement NIST FIPS-validated cryptography for the following: to provision digital signatures, to generate cryptographic hashes, and to protect unclassified information requiring confidentiality and cryptographic protection in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.SV-263659r982563_rule: The operating system must include only approved trust anchors in trust stores or certificate stores managed by the organization.
Verify
cosign verify ghcr.io/pair-ai-platform/python:3.11.18-20261110.8 \
--certificate-identity-regexp '^https://github.com/Pair-AI-Platform/python/.github/workflows/build.yml@' \
--certificate-oidc-issuer https://token.actions.githubusercontent.com
gh attestation verify oci://ghcr.io/pair-ai-platform/python:3.11.18-20261110.8 --repo Pair-AI-Platform/python3.11.18-20261110.7
ghcr.io/pair-ai-platform/python:3.11.18-20261110.7
Python 3.11.18 (runtime). Index digest sha256:836e9a5130189b4a0cf0105ed476a0da4729a6e7bf62f2d574a63e6dad707ce5.
Tags: 3.11.18-20261110.7, 3.11, 3.11.18.
What changed
First release of this image.
SBOM and size
| Architecture | Packages (SBOM) | Compressed | Installed |
|---|---|---|---|
| x86_64 | 38 | 58.6 MB | 58.6 MB |
| aarch64 | 38 | 55.4 MB | 147.7 MB |
Main components: ca-certificates-bundle 20261020-r0, glibc-2.44 2.44-r16, libffi 3.8.0-r2, libstdc++ 16.2.0-r3, openssl-3.6-libcrypto 3.6.5-r6, openssl-3.6-libssl 3.6.5-r6, openssl-4.0-libcrypto 4.0.3-r8, openssl-4.0-libssl 4.0.3-r8, py3-pip-wheel 26.2.2-r2, python-3.11-upstream 3.11.18-r0, python-3.13-base 3.13.18_git20261030-r0, sqlite-libs 3.54.1-r0.
The SPDX SBOMs are attached to this release and to each image as signed attestations.
Scans
| Architecture | Hardening profile, DISA GPOS SRG (applicable rules passed) | Not applicable | Vulnerabilities (C / H / M / L) |
|---|---|---|---|
| x86_64 | 85 / 91 (93.4%) | 107 | 0 / 2 / 0 / 0 |
| aarch64 | 85 / 91 (93.4%) | 107 | 0 / 2 / 0 / 0 |
Vulnerabilities
| ID | Severity | Package | Installed | Comes from | Fixed upstream in | Architectures |
|---|---|---|---|---|---|---|
| CVE-2026-119586 | High | sqlite-libs |
3.54.1-r0 | sqlite-libs 3.54.1-r0 |
no fix yet | x86_64, aarch64 |
| CVE-2026-84243 | High | glibc-2.44 |
2.44-r16 | glibc-2.44 2.44-r16 |
no fix yet | x86_64, aarch64 |
Comes from is the Wolfi package that brings the affected code into the image; a library bundled inside the toolchain, for example, comes from that package. Fixed upstream in is the version of the affected code that fixes it; the image gets the fix when the package it comes from ships that version, and the next build after that publishes it.
Hardening-profile rules not passed (x86_64):
SV-203649r971535_rule: The operating system must use mechanisms meeting the requirements of applicable federal laws, Executive orders, directives, policies, regulations, standards, and guidance for authentication to a cryptographic module.SV-203739r987791_rule: The operating system must implement NSA-approved cryptography to protect classified information in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.SV-203750r958912_rule: The operating system must maintain the confidentiality and integrity of information during preparation for transmission.SV-203751r958914_rule: The operating system must maintain the confidentiality and integrity of information during reception.SV-203776r959006_rule: The operating system must implement NIST FIPS-validated cryptography for the following: to provision digital signatures, to generate cryptographic hashes, and to protect unclassified information requiring confidentiality and cryptographic protection in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.SV-263659r982563_rule: The operating system must include only approved trust anchors in trust stores or certificate stores managed by the organization.
Verify
cosign verify ghcr.io/pair-ai-platform/python:3.11.18-20261110.7 \
--certificate-identity-regexp '^https://github.com/Pair-AI-Platform/python/.github/workflows/build.yml@' \
--certificate-oidc-issuer https://token.actions.githubusercontent.com
gh attestation verify oci://ghcr.io/pair-ai-platform/python:3.11.18-20261110.7 --repo Pair-AI-Platform/python3.10.22-dev-20261110.8
ghcr.io/pair-ai-platform/python:3.10.22-dev-20261110.8
Python 3.10.22 (dev). Index digest sha256:4b0eac3935aa8f9a1b5eb5233e0c5a604880d40ab8e1baa9d17ec50d54113f63.
Tags: 3.10.22-dev-20261110.8, 3.10-dev, 3.10.22-dev.
What changed
No package changed; the image metadata did.
SBOM and size
| Architecture | Packages (SBOM) | Compressed | Installed |
|---|---|---|---|
| x86_64 | 79 | 291.8 MB | 291.8 MB |
| aarch64 | 79 | 274.9 MB | 794.4 MB |
Main components: binutils 2.47-r4, ca-certificates-bundle 20261020-r0, gcc 16.2.0-r3, git 2.56.0-r3, glibc-2.44 2.44-r16, glibc-2.44-dev 2.44-r16, libffi 3.8.0-r2, libffi-dev 3.8.0-r2, libstdc++ 16.2.0-r3, libstdc++-dev 16.2.0-r3, make 4.4.1-r15, openssl-3.6-libcrypto 3.6.5-r6, openssl-3.6-libssl 3.6.5-r6, openssl-4.0-dev 4.0.3-r8, openssl-4.0-libcrypto 4.0.3-r8, openssl-4.0-libssl 4.0.3-r8, py3-pip-wheel 26.2.2-r2, python-3.10-upstream 3.10.22-r0, python-3.10-upstream-dev 3.10.22-r0, python-3.13-base 3.13.18_git20261030-r0, sqlite-libs 3.54.1-r0.
The SPDX SBOMs are attached to this release and to each image as signed attestations.
Scans
| Architecture | Hardening profile, DISA GPOS SRG (applicable rules passed) | Not applicable | Vulnerabilities (C / H / M / L) |
|---|---|---|---|
| x86_64 | 85 / 91 (93.4%) | 107 | 0 / 2 / 0 / 0 |
| aarch64 | 85 / 91 (93.4%) | 107 | 0 / 2 / 0 / 0 |
Vulnerabilities
| ID | Severity | Package | Installed | Comes from | Fixed upstream in | Architectures |
|---|---|---|---|---|---|---|
| CVE-2026-119586 | High | sqlite-libs |
3.54.1-r0 | sqlite-libs 3.54.1-r0 |
no fix yet | x86_64, aarch64 |
| CVE-2026-84243 | High | glibc-2.44 |
2.44-r16 | glibc-2.44 2.44-r16 |
no fix yet | x86_64, aarch64 |
Comes from is the Wolfi package that brings the affected code into the image; a library bundled inside the toolchain, for example, comes from that package. Fixed upstream in is the version of the affected code that fixes it; the image gets the fix when the package it comes from ships that version, and the next build after that publishes it.
Hardening-profile rules not passed (x86_64):
SV-203649r971535_rule: The operating system must use mechanisms meeting the requirements of applicable federal laws, Executive orders, directives, policies, regulations, standards, and guidance for authentication to a cryptographic module.SV-203739r987791_rule: The operating system must implement NSA-approved cryptography to protect classified information in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.SV-203750r958912_rule: The operating system must maintain the confidentiality and integrity of information during preparation for transmission.SV-203751r958914_rule: The operating system must maintain the confidentiality and integrity of information during reception.SV-203776r959006_rule: The operating system must implement NIST FIPS-validated cryptography for the following: to provision digital signatures, to generate cryptographic hashes, and to protect unclassified information requiring confidentiality and cryptographic protection in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.SV-263659r982563_rule: The operating system must include only approved trust anchors in trust stores or certificate stores managed by the organization.
Verify
cosign verify ghcr.io/pair-ai-platform/python:3.10.22-dev-20261110.8 \
--certificate-identity-regexp '^https://github.com/Pair-AI-Platform/python/.github/workflows/build.yml@' \
--certificate-oidc-issuer https://token.actions.githubusercontent.com
gh attestation verify oci://ghcr.io/pair-ai-platform/python:3.10.22-dev-20261110.8 --repo Pair-AI-Platform/python3.10.22-dev-20261110.7
ghcr.io/pair-ai-platform/python:3.10.22-dev-20261110.7
Python 3.10.22 (dev). Index digest sha256:874cceab98704a0a04dba17fb15c31e252f14c32d0268b11c1866916f9c0b958.
Tags: 3.10.22-dev-20261110.7, 3.10-dev, 3.10.22-dev.
What changed
First release of this image.
SBOM and size
| Architecture | Packages (SBOM) | Compressed | Installed |
|---|---|---|---|
| x86_64 | 79 | 291.7 MB | 291.7 MB |
| aarch64 | 79 | 274.9 MB | 794.4 MB |
Main components: binutils 2.47-r4, ca-certificates-bundle 20261020-r0, gcc 16.2.0-r3, git 2.56.0-r3, glibc-2.44 2.44-r16, glibc-2.44-dev 2.44-r16, libffi 3.8.0-r2, libffi-dev 3.8.0-r2, libstdc++ 16.2.0-r3, libstdc++-dev 16.2.0-r3, make 4.4.1-r15, openssl-3.6-libcrypto 3.6.5-r6, openssl-3.6-libssl 3.6.5-r6, openssl-4.0-dev 4.0.3-r8, openssl-4.0-libcrypto 4.0.3-r8, openssl-4.0-libssl 4.0.3-r8, py3-pip-wheel 26.2.2-r2, python-3.10-upstream 3.10.22-r0, python-3.10-upstream-dev 3.10.22-r0, python-3.13-base 3.13.18_git20261030-r0, sqlite-libs 3.54.1-r0.
The SPDX SBOMs are attached to this release and to each image as signed attestations.
Scans
| Architecture | Hardening profile, DISA GPOS SRG (applicable rules passed) | Not applicable | Vulnerabilities (C / H / M / L) |
|---|---|---|---|
| x86_64 | 85 / 91 (93.4%) | 107 | 0 / 2 / 0 / 0 |
| aarch64 | 85 / 91 (93.4%) | 107 | 0 / 2 / 0 / 0 |
Vulnerabilities
| ID | Severity | Package | Installed | Comes from | Fixed upstream in | Architectures |
|---|---|---|---|---|---|---|
| CVE-2026-119586 | High | sqlite-libs |
3.54.1-r0 | sqlite-libs 3.54.1-r0 |
no fix yet | x86_64, aarch64 |
| CVE-2026-84243 | High | glibc-2.44 |
2.44-r16 | glibc-2.44 2.44-r16 |
no fix yet | x86_64, aarch64 |
Comes from is the Wolfi package that brings the affected code into the image; a library bundled inside the toolchain, for example, comes from that package. Fixed upstream in is the version of the affected code that fixes it; the image gets the fix when the package it comes from ships that version, and the next build after that publishes it.
Hardening-profile rules not passed (x86_64):
SV-203649r971535_rule: The operating system must use mechanisms meeting the requirements of applicable federal laws, Executive orders, directives, policies, regulations, standards, and guidance for authentication to a cryptographic module.SV-203739r987791_rule: The operating system must implement NSA-approved cryptography to protect classified information in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.SV-203750r958912_rule: The operating system must maintain the confidentiality and integrity of information during preparation for transmission.SV-203751r958914_rule: The operating system must maintain the confidentiality and integrity of information during reception.SV-203776r959006_rule: The operating system must implement NIST FIPS-validated cryptography for the following: to provision digital signatures, to generate cryptographic hashes, and to protect unclassified information requiring confidentiality and cryptographic protection in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.SV-263659r982563_rule: The operating system must include only approved trust anchors in trust stores or certificate stores managed by the organization.
Verify
cosign verify ghcr.io/pair-ai-platform/python:3.10.22-dev-20261110.7 \
--certificate-identity-regexp '^https://github.com/Pair-AI-Platform/python/.github/workflows/build.yml@' \
--certificate-oidc-issuer https://token.actions.githubusercontent.com
gh attestation verify oci://ghcr.io/pair-ai-platform/python:3.10.22-dev-20261110.7 --repo Pair-AI-Platform/python