chore(deps): update wolfi (versioned)

[elastic-renovate-prod]

This PR contains the following updates:

Package	Type	Update	Change
docker.elastic.co/wolfi/chainguard-base	final	digest	e59b9c1 -> 7adf8e4
docker.elastic.co/wolfi/python (source)	stage	minor	v3.12.13-r3-dev -> v3.14.4-r4-dev

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

In operator/Dockerfile the build argument ARG PYTHON_GLIBC_IMAGE_VERSION was updated from v3.12.13-r1-dev@sha256:96116eea5be2f659814307582781f08693c5f99f50c540cf8386b8d4728b2013 to v3.14.4-r1-dev@sha256:2135f4819ba05f84e6ea8d250813ac09e48bd216993fbf3671341565cd2e221e. The FROM ${PYTHON_GLIBC_IMAGE}:${PYTHON_GLIBC_IMAGE_VERSION} AS build line now references the new digest. No other Dockerfile stages, arguments, or build steps were changed.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch renovate/wolfi-versioned

• 🛠️ Update Documentation: Commit on current branch
• 🛠️ Update Documentation: Create PR

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

operator/Dockerfile (1)

25-25: ⚠️ Potential issue | 🟠 Major

Python version mismatch between build stages.

Glibc stage uses Python 3.14 (line 7), but musl stage uses 3.12 (line 25). This could cause behavioral differences or incompatibilities between environments.

Update to python:3.14-alpine for consistency.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@operator/Dockerfile` at line 25, The musl build stage in the Dockerfile uses
FROM python:3.12-alpine which mismatches the glibc stage's python:3.14; update
the musl stage Dockerfile line (the FROM for the build-musl stage) to FROM
python:3.14-alpine so both build stages use the same Python version.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@operator/Dockerfile`:
- Line 2: The Dockerfile uses ARG PYTHON_GLIBC_IMAGE_VERSION set to a Python
3.14 image, but the CI matrix doesn't include 3.14; update the CI workflow
matrix to include the py314 entry with value "3.14" so CI tests cover the same
Python version declared in pyproject.toml and used by ARG
PYTHON_GLIBC_IMAGE_VERSION in the operator image.

---

Outside diff comments:
In `@operator/Dockerfile`:
- Line 25: The musl build stage in the Dockerfile uses FROM python:3.12-alpine
which mismatches the glibc stage's python:3.14; update the musl stage Dockerfile
line (the FROM for the build-musl stage) to FROM python:3.14-alpine so both
build stages use the same Python version.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: a61c466c-7c53-44fb-a133-9d7a8de67986

📥 Commits

Reviewing files that changed from the base of the PR and between 3162292 and 0884ed1.

📒 Files selected for processing (1)

• operator/Dockerfile

[coderabbitai]

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Verify Python 3.14 is not in CI test matrix
rg -n "py314|3\.14" .github/workflows/ci.yml

Repository: elastic/elastic-otel-python

Length of output: 53

---

🏁 Script executed:

git ls-files operator/Dockerfile

Repository: elastic/elastic-otel-python

Length of output: 90

---

🏁 Script executed:

wc -l operator/Dockerfile && cat -n operator/Dockerfile

Repository: elastic/elastic-otel-python

Length of output: 1763

---

🏁 Script executed:

wc -l .github/workflows/ci.yml && head -100 .github/workflows/ci.yml

Repository: elastic/elastic-otel-python

Length of output: 3168

---

🏁 Script executed:

rg -A 5 "python|PYTHON" .github/workflows/ci.yml | head -50

Repository: elastic/elastic-otel-python

Length of output: 1385

---

🏁 Script executed:

cat -n operator/requirements.txt

Repository: elastic/elastic-otel-python

Length of output: 3076

---

🏁 Script executed:

cat -n pyproject.toml | head -50

Repository: elastic/elastic-otel-python

Length of output: 2164

---

Python 3.14 not tested in CI but used in operator image.

The Dockerfile builds with Python 3.14.4 (line 2, 7) and copies those packages into the final operator image, but the CI test matrix only covers 3.9–3.13. Since the project declares Python 3.14 support (pyproject.toml), add py314: "3.14" to the test matrix in .github/workflows/ci.yml before merging.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@operator/Dockerfile` at line 2, The Dockerfile uses ARG
PYTHON_GLIBC_IMAGE_VERSION set to a Python 3.14 image, but the CI matrix doesn't
include 3.14; update the CI workflow matrix to include the py314 entry with
value "3.14" so CI tests cover the same Python version declared in
pyproject.toml and used by ARG PYTHON_GLIBC_IMAGE_VERSION in the operator image.

[macroscopeapp]

🟠 High operator/Dockerfile:2

The PYTHON_GLIBC_IMAGE_VERSION bump from 3.12 to 3.14 causes pip install --target to select wheels with the cp314 ABI. Native extension .so files (e.g., wrapt/_wrappers.cpython-314-x86_64-linux-gnu.so) will fail to load in user applications running Python 3.12 or 3.13, throwing ImportError at runtime when auto-instrumentation is injected. Additionally, the build-musl stage still uses Python 3.12, creating an inconsistency where musl and glibc auto-instrumentation require different Python versions.

-ARG PYTHON_GLIBC_IMAGE_VERSION="v3.14.4-r1-dev@sha256:cf184a81e58e93fd1886843735b53352e912de783fc2bf5965d7cb35c5cb30c1"
+ARG PYTHON_GLIBC_IMAGE_VERSION="v3.12.13-r1-dev@sha256:96116eea5be2f659814307582781f08693c5f99f50c540cf8386b8d4728b2013"

🚀 Reply "fix it for me" or copy this AI Prompt for your agent:

In file operator/Dockerfile around line 2:

The `PYTHON_GLIBC_IMAGE_VERSION` bump from 3.12 to 3.14 causes `pip install --target` to select wheels with the cp314 ABI. Native extension `.so` files (e.g., `wrapt/_wrappers.cpython-314-x86_64-linux-gnu.so`) will fail to load in user applications running Python 3.12 or 3.13, throwing `ImportError` at runtime when auto-instrumentation is injected. Additionally, the `build-musl` stage still uses Python 3.12, creating an inconsistency where musl and glibc auto-instrumentation require different Python versions.