chore(deps): update dependency python to v3.15.0 (.github/workflows/test-helm-chart.yml)

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
python	uses-with	minor	3.14 → 3.15
python (source)	stage	minor	3.14.8-alpine3.23 → 3.15.0-alpine3.23
python (source)	final	minor	3.14.8-slim-trixie → 3.15.0-slim-trixie
python (source)	final	minor	3.14.8-alpine3.23 → 3.15.0-alpine3.23

---

Release Notes

actions/python-versions (python)

v3.15.0: 3.15.0

Compare Source

Python 3.15.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Only on Wednesday (* * * * 3)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[Maffooch]

Adversarial review: chore(deps): update dependency python to v3.15.0 (.github/workflows/test-helm-chart.yml)

Verdict: request-changes
Reviewed at: ddd0d97 Profile: dependency-bump
Repo rules followed: origin/dev .claude/skills/review-pr/SKILL.md (points to .claude/skills/defectdojo-dev/SKILL.md step 7), plus the generic review-pr skill

The django image no longer builds on amd64. On Python 3.15, isal (pulled in by vulners==4.3.0) has no wheel. It has to build from source, and that needs nasm, which neither build stage installs. The required check Unit Tests Complete is red because of this.

Attempts to break it

1. Required CI. Read run 38764255960. Build Docker Images (django, debian, linux/amd64) failed at pip3 wheel -r requirements.txt with make: nasm: No such file or directory, then Failed to build isal. The alpine django and nginx builds were cancelled when it failed, so they never finished. Unit Tests Complete is red (success success failure skipped ...). The last three dev merge-group runs (38981711947, 38980988227, 38980835504) built all four django images green on 3.14.8, so this is not a base artifact. blocker
2. Every pinned dependency has 3.15 wheels or builds. Pulled every distribution the CI build resolved on 3.15 debian amd64 (130 files, from the job log). Ten came down as sdists: brotli 1.2.0, cpe 1.3.1, isal 1.8.0, psycopg-c 3.3.6, PyYAML 6.0.3, stream-inflate 0.0.43, stream-unzip 0.0.101, titlecase 2.4.1, uWSGI 2.0.31, zstandard 0.25.0. Checked PyPI for each one. psycopg-c, uWSGI, cpe and titlecase ship no wheels on any Python, so 3.14 builds them from source too. isal, brotli, zstandard, PyYAML, stream-inflate and stream-unzip publish wheels up to cp314 only. Those six move from wheels to source builds with this PR. All of them are already the latest release on PyPI, so no newer pin fixes it. The other 15 compiled packages (cryptography, lxml, pydantic_core, orjson, pillow and so on) all have cp315 or abi3 wheels for manylinux and musllinux on x86_64 and aarch64. The one exception is pycurl, which has no musllinux wheel, but that is also true on cp314. blocker for isal. The others build.
3. Reproduced the isal failure and the fix. Built isal==1.8.0 on python:3.15.0-alpine3.23 (linux/amd64, pinned digest). With only build-base, it fails with make: nasm: No such file or directory. With build-base nasm added, it builds isal-1.8.0-cp315-cp315-linux_x86_64.whl. The same thing on python:3.15.0-slim-trixie amd64 with build-essential nasm also built the wheel. So alpine amd64 fails the same way debian does. The fix is to add nasm to the build stage of Dockerfile.django-debian, Dockerfile.django-alpine and Dockerfile.nginx-alpine. Another option is to wait for isal to publish cp315 wheels. blocker
4. arm64. Built the build stage of Dockerfile.django-alpine and Dockerfile.django-debian natively on linux/arm64 from the PR head. Both finished (exit=0). All eleven and ten sdists built, isal included, because isal's aarch64 code does not use nasm. Green arm64 does not cover amd64. no break on arm64
5. Image digests are pinned and match. docker buildx imagetools inspect resolves python:3.15.0-alpine3.23 to sha256:70ba88b1...74c2 and python:3.15.0-slim-trixie to sha256:f48fda6d...1619. Both are exactly the digests in the diff. Both are multi-arch indexes with linux/amd64 and linux/arm64/v8. The old 3.14.8 digests also match their tags. The alpine digest is used in both alpine Dockerfiles, and the debian digest in both debian Dockerfiles. no break
6. Workflow change. test-helm-chart.yml:32 now asks setup-python for 3.15. The Lint chart (version) job log shows it downloaded python-3.15.0-linux-24.04-x64 from actions/python-versions, and the job passed. The action pin (5fda3b95..., v7.0.0) did not change. no break
7. Runtime support. Django==5.2.17 (requirements.txt:24) lists classifiers up to Python 3.14 on PyPI. 3.15 is not a declared supported version. Grepped the repo for APIs removed in 3.15 (CGIHTTPRequestHandler, no_type_check_decorator, getdefaultlocale, sre_*, java_ver). No hits. The test suite never ran on 3.15 because the image build failed, so runtime behavior is untested. follow-up: run the full suite once the image builds.
8. Diff is only the stated bump. Five files, five one-line changes, all 3.14.8 to 3.15.0 (or 3.14 to 3.15). No requirement changes. Dockerfile.integration-tests-debian only pip-installs selenium and requests, so it is not affected, and its CI build passed. no break

Blocking

• Dockerfile.django-debian:8, Dockerfile.django-alpine:8, Dockerfile.nginx-alpine:8: moving to 3.15 forces a source build of isal 1.8.0 (from vulners==4.3.0, requirements.txt:68). On amd64 that build needs nasm, and the build stages do not install it. The amd64 image build fails and the required Unit Tests Complete check is red. Add nasm to the build-stage package lists (apt in Dockerfile.django-debian:14-24, apk in Dockerfile.django-alpine:14-27 and the matching block in Dockerfile.nginx-alpine), or hold the bump until isal ships cp315 wheels.

Nice to have

• Five more packages (brotli, zstandard, PyYAML, stream-inflate, stream-unzip) now compile from source on every image build, which makes builds slower. In the native arm64 build-stage run the whole wheel step took about 20 to 28 minutes, with uWSGI taking the longest. That is acceptable, but consider pinning the image to 3.14 until upstream wheels land.
• Django 5.2 does not declare 3.15 support. Check the upgrade plan before shipping it in a release image.
• The PR has no milestone. The repo checklist expects the earliest open future milestone.

Verified hands-on

• Image digests against the registry (docker buildx imagetools inspect).
• isal==1.8.0 build on 3.15 amd64: fails without nasm on alpine, builds with nasm on alpine and debian.
• Build stage of Dockerfile.django-alpine and Dockerfile.django-debian on linux/arm64 from the PR head: both pass.
• Wheel availability for every resolved compiled package, checked against PyPI JSON.

Checked only statically

• Full amd64 image build failure (CI log of run 38764255960, not rebuilt locally end to end).
• Python 3.15 API removals (grep only).
• The workflow change (CI job log).

Still needs verification

• Full unit test suite, REST tests and k8s tests on a 3.15 image once it builds.
• The nginx-alpine amd64 build was cancelled in CI. It runs the same pip3 wheel step, so it is expected to fail the same way (not run end to end).