No Dockerfile pins its base image tag, so the interpreter version moves whenever an image is rebuilt.
This has already bitten once: models.py referenced IcecastConfig about 85 lines before its definition and ran only because python:slim-trixie currently ships Python 3.14, where PEP 649 defers annotation evaluation. The same file is a hard NameError on 3.13 or earlier. The ordering was fixed on 2026-08-16; the unpinned base remains.
This class of bug is invisible to flake8 as configured and surfaces only as a container that will not start. Part of the wider no-lockfiles problem — Server/infra/.terraform.lock.hcl is the only pinned dependency in the entire project.
No Dockerfile pins its base image tag, so the interpreter version moves whenever an image is rebuilt.
This has already bitten once: `models.py` referenced `IcecastConfig` about 85 lines before its definition and ran only because `python:slim-trixie` currently ships Python 3.14, where PEP 649 defers annotation evaluation. The same file is a hard `NameError` on 3.13 or earlier. The ordering was fixed on 2026-08-16; the unpinned base remains.
This class of bug is invisible to flake8 as configured and surfaces only as a container that will not start. Part of the wider no-lockfiles problem — `Server/infra/.terraform.lock.hcl` is the only pinned dependency in the entire project.
Fixed in the client repo — logan/node-26 commit 28266b4, "Pin the op25 container to a Python major version". Filing it under server-26 was wrong; the offending file is Client/op25-container/Dockerfile.
The issue also overstated the problem. Every other Dockerfile in both repos already pinned a major version:
Dockerfile
base
Server/drb-c2-core
python:3.12-slim
Server/drb-server-discord-bot
python:3.12-slim
Server/drb-frontend
node:20-slim
Client/drb-edge-node
python:3.14-slim
Client/icecast
debian:bookworm-slim
Client/op25-container was the only genuinely unpinned one (python:slim-trixie carries no version at all), and it is also the one the PEP 649 / IcecastConfig incident happened in. It is now python:3.14-slim, matching drb-edge-node, so patch releases still float for security updates while the major version is nailed down.
The DEFERRED.md row for this has been removed. The wider no-lockfiles problem (no package-lock.json, no Python lockfile) is untouched and still real — that is a separate, bigger piece of work.
Fixed in the **client** repo — `logan/node-26` commit `28266b4`, "Pin the op25 container to a Python major version". Filing it under server-26 was wrong; the offending file is `Client/op25-container/Dockerfile`.
The issue also overstated the problem. Every other Dockerfile in both repos already pinned a major version:
| Dockerfile | base |
|---|---|
| `Server/drb-c2-core` | `python:3.12-slim` |
| `Server/drb-server-discord-bot` | `python:3.12-slim` |
| `Server/drb-frontend` | `node:20-slim` |
| `Client/drb-edge-node` | `python:3.14-slim` |
| `Client/icecast` | `debian:bookworm-slim` |
`Client/op25-container` was the only genuinely unpinned one (`python:slim-trixie` carries no version at all), and it is also the one the PEP 649 / `IcecastConfig` incident happened in. It is now `python:3.14-slim`, matching drb-edge-node, so patch releases still float for security updates while the major version is nailed down.
The DEFERRED.md row for this has been removed. The wider no-lockfiles problem (no `package-lock.json`, no Python lockfile) is untouched and still real — that is a separate, bigger piece of work.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
No Dockerfile pins its base image tag, so the interpreter version moves whenever an image is rebuilt.
This has already bitten once:
models.pyreferencedIcecastConfigabout 85 lines before its definition and ran only becausepython:slim-trixiecurrently ships Python 3.14, where PEP 649 defers annotation evaluation. The same file is a hardNameErroron 3.13 or earlier. The ordering was fixed on 2026-08-16; the unpinned base remains.This class of bug is invisible to flake8 as configured and surfaces only as a container that will not start. Part of the wider no-lockfiles problem —
Server/infra/.terraform.lock.hclis the only pinned dependency in the entire project.Fixed in the client repo —
logan/node-26commit28266b4, "Pin the op25 container to a Python major version". Filing it under server-26 was wrong; the offending file isClient/op25-container/Dockerfile.The issue also overstated the problem. Every other Dockerfile in both repos already pinned a major version:
Server/drb-c2-corepython:3.12-slimServer/drb-server-discord-botpython:3.12-slimServer/drb-frontendnode:20-slimClient/drb-edge-nodepython:3.14-slimClient/icecastdebian:bookworm-slimClient/op25-containerwas the only genuinely unpinned one (python:slim-trixiecarries no version at all), and it is also the one the PEP 649 /IcecastConfigincident happened in. It is nowpython:3.14-slim, matching drb-edge-node, so patch releases still float for security updates while the major version is nailed down.The DEFERRED.md row for this has been removed. The wider no-lockfiles problem (no
package-lock.json, no Python lockfile) is untouched and still real — that is a separate, bigger piece of work.