Setting the version number in a custom build

[alesnav]

Hello there!

I am building a custom Docker image based on the official published Docker images inside Docker hub, by using the specific commit. The reason is to install all other requirements and packages needed in my environment, so the deployment reload lasts seconds instead of minutes (if I do it using superset-config or entrypoint bash code). I am facing two issues when publishing and using my custom Docker image:

1. I am using an extended DevSecOps pipeline which uses Trivy to scan vulnerabilities (SCA). Whenever I build the custom image, it is tagged as "0.0.0-dev", so Trivy answers including all CVE linked to Superset, regardless the version, even if I use the last published Superset image.
2. When the deployment uses the custom Docker image, the end user can see "Version: 0.0.0-dev" in the menu opctions, below "About" section.

I'd like to patch the version code to {SUPERSET_VERSION}-git.{BASE_IMAGE_COMMIT_SHA}; but I don't know how can I do it.

Could you please help me to get this fixed in my environment?

Thanks!

[dosubot[bot]]

Hey @alesnav! The version is ultimately determined by the file /app/superset/static/version_info.json inside the container. The simplest fix for a custom image built on top of the official one is to overwrite that file directly in your Dockerfile.

For example, to set it to 4.1.1-git.abc123:

FROM apache/superset:4.1.1

# ... your custom packages/requirements ...

ARG SUPERSET_VERSION=4.1.1
ARG BASE_IMAGE_COMMIT_SHA=unknown

RUN echo "{\"version\": \"${SUPERSET_VERSION}-git.${BASE_IMAGE_COMMIT_SHA}\", \"GIT_SHA\": \"${BASE_IMAGE_COMMIT_SHA}\"}" > \
    /app/superset/static/version_info.json

Then build with:

docker build \
  --build-arg SUPERSET_VERSION=4.1.1 \
  --build-arg BASE_IMAGE_COMMIT_SHA=$(git rev-parse --short HEAD) \
  -t my-superset:custom .

This will:

1. Set the version that Trivy sees in the package metadata (solving your SCA scan issue).
2. Display your custom version string (e.g. 4.1.1-git.a1b2c3d) in the UI under Settings → About [1].

The version flows from version_info.json → config.py at startup [2] → bootstrap payload sent to the frontend [3] → rendered in the About section.

If Trivy is specifically reading the Python package metadata (from pip), you may also need to patch the installed package version. In that case, add:

RUN sed -i "s/^Version:.*/Version: ${SUPERSET_VERSION}/" \
    /app/superset.egg-info/PKG-INFO 2>/dev/null || true

Hope that helps!

To reply, just mention @dosu.

---

Docs are dead. Just use Dosu.

[alesnav]

It seems that patching just /app/superset/static/version_info.json is not enough. After testing it several times, these three files need to be patched:

• /app/superset/static/version_info.json
• /app/.venv/lib/python3.*/site-packages/apache_superset-*.dist-info/METADATA
• /app/apache_superset.egg-info/PKG-INFO

[FrancescoCastaldi]

The "0.0.0-dev" string comes from two places in Superset:

1. superset-frontend/package.json where the default npm package version is set to "0.0.0-dev".
2. superset/config.py, where VERSION_STRING is resolved by reading static/version_info.json or falling back to static/assets/package.json.

When Trivy scans your custom image, it inspects Python package metadata (.dist-info/METADATA) or package.json. If it detects 0.0.0-dev, it treats the build as an unreleased dev snapshot and flags all known CVEs.

Here is how to patch both the UI display and the package version in your Dockerfile:

1. Patch version_info.json and VERSION_STRING in Dockerfile

In your Dockerfile, after installing your custom requirements, generate the static/version_info.json file and set the build environment variables:

ARG SUPERSET_VERSION=6.1.0
ARG COMMIT_SHA=abcdef12

# Write version_info.json read by superset/config.py
RUN python -c "import json; json.dump({'version': '${SUPERSET_VERSION}', 'GIT_SHA': '${COMMIT_SHA}'}, open('/app/superset/static/version_info.json', 'w'))"

# Patch frontend package.json if present
RUN if [ -f /app/superset/static/assets/package.json ]; then \
      sed -i 's/"version": "0.0.0-dev"/"version": "'"${SUPERSET_VERSION}"'"/' /app/superset/static/assets/package.json; \
    fi

2. Override VERSION_STRING in superset_config.py

You can also set the version string explicitly in your superset_config.py without touching container files:

# In superset_config.py
import os

SUPERSET_VERSION = os.environ.get("SUPERSET_VERSION", "6.1.0")
COMMIT_SHA = os.environ.get("COMMIT_SHA", "custom")

VERSION_STRING = f"{SUPERSET_VERSION}-git.{COMMIT_SHA}"
BUILD_NUMBER = COMMIT_SHA

3. Ensure Python Package Metadata reflects the release (for Trivy)

If you install Superset from a local directory in editable mode (pip install -e .), setuptools_scm generates 0.0.0.dev0 if git tags are missing. Pass SETUPTOOLS_SCM_PRETEND_VERSION during build:

ENV SETUPTOOLS_SCM_PRETEND_VERSION=${SUPERSET_VERSION}

This ensures Trivy recognizes the exact release version and avoids false positive vulnerability alerts.