App Service Linux Python 3.13 image: Flask/virtualenv security fixes, rollout and recovery

Question

I am seeking guidance on Microsoft's published built-in Linux Python App Service image, rather than a custom application vulnerability.

The public image mcr.microsoft.com/appsvc/python:3.13_20261016.7.tuxprod resolves to sha256:9c4a62e766c9a1e18f20ecc1acbda08fbab8df41ba1bcabe9705dc3c79942126. In an isolated container test it runs Python 3.13.16 but its base Python environment still contains Flask 3.1.2, virtualenv 20.36.1 and appsvc-code-profiler 1.0.0.

A version-based public package audit flags Flask GHSA-68rp-wp8r-4726 (upstream fix 3.1.3) and virtualenv advisories including GHSA-p58f-9548-mpm2 (upstream fix 21.7.13). The Windows-only virtualenv activate.bat finding does not apply to Linux, and the bash/fish issue requires crafted path/activation conditions. These version matches do not establish exploitability or rule out Microsoft backports. The vendor-only profiler cannot be assessed through public PyPI.

Could the App Service team clarify:

1. Are the relevant fixes backported in this image? If so, where is the corresponding image/build or security assurance documented?
2. Which supported built-in Python 3.13 image contains the fixes, and how can customers establish its availability on the Standard release channel before changing a production app?
3. Is installing patched versions in an application virtual environment sufficient for any relevant platform usage, or do separate base-interpreter services require an updated Microsoft image?
4. What is the supported recovery path if a managed runtime update fails? Re-deploying application code or restoring app content does not appear to pin a prior managed image, and reverting a release channel does not guarantee an exact prior build.
5. Where can customers find security support/update assurance for appsvc-code-profiler?

The goal is a supported patch and verification path with controlled production impact. No customer-specific identifiers or logs are included.