fix: resolve vulnerabilities by PhBouzid · Pull Request #50 · Netcracker/qubership-backup-daemon

PhBouzid · 2026-01-20T17:54:45Z

What type of PR is this? (check all applicable)

Description

TDB

Related Tickets & Documents

Related Issue #
Closes #

QA Instructions, Screenshots, Recordings

Please replace this line with instructions on how to test your changes, a note
on the devices and browsers this has been tested on, as well as any relevant
images for UI changes.

Breaking Change checklist

If your PR includes any deployment or processing changes, please utilize this checklist:

Does it change any deployment parameters, logic of their working or rename them?
Did update from previous version tested with the same set of deployment parameters?

Added/updated tests?

Yes
No, and this is why: please replace this line with details on why tests
have not been included
I need help with writing tests

[optional] Are there any things to highlight or double check?

[optional] What gif best describes this PR or how it makes you feel?

github-actions · 2026-01-20T17:54:59Z

Thank you for your submission, we really appreciate it. Like many open-source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution. You can sign the CLA by just posting a Pull Request Comment same as the below format.

I have read the CLA Document and I hereby sign the CLA

1 out of 2 committers have signed the CLA.
✅ (PhBouzid)[https://github.com/PhBouzid]
❌ @fibu0125
fibu0125 seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
_{You can retrigger this bot by commenting recheck in this Pull Request.}_{Posted by the CLA Assistant Lite bot.}

Copilot

Pull request overview

This pull request addresses security vulnerabilities by updating dependencies and improving thread safety in the database layer.

Changes:

Upgraded urllib3 (2.0.6 → 2.6.3) and Werkzeug (3.0.6 → 3.1.5) to address security vulnerabilities
Updated PIP (22.2.0 → 25.3.0) and SETUPTOOLS (70.0.0 → 80.9.0) in the Alpine Dockerfile
Refactored DB class to store connections instead of cursors, added threading locks, and implemented cursor context managers for better resource management

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated 4 comments.

File	Description
requirements.txt	Updated urllib3 and Werkzeug to newer versions to resolve security vulnerabilities
alpine/Dockerfile	Updated PIP and SETUPTOOLS versions to their latest releases
src/db.py	Enhanced thread safety with locks, changed to connection-based architecture, and added cursor context managers

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-01-20T17:58:14Z

src/db.py



 class DB:
+    _lock = threading.Lock()


The _lock is a class-level attribute shared across all DB instances. This means all database operations across different database files will compete for the same lock, which could cause unnecessary serialization and performance degradation. Consider using an instance-level lock (self._lock = threading.Lock() in init) if each DB instance operates on a separate database file.

Copilot · 2026-01-20T17:58:14Z

src/db.py

+        with DB._lock:
+            log.debug("SQL command: " + sql.replace('?', '%s') % args)
+            cursor.execute(sql, args)


The threading lock is being used only around the logging and execute operations in __log_and_execute, but this may not provide adequate thread safety. The lock should protect the entire database operation sequence, not just the execute call. Consider that cursor operations might need protection at a higher level, or use connection-level locks instead of a class-level lock since each DB instance has its own connection.

Copilot · 2026-01-20T17:58:14Z

src/db.py

            if login:
                cursor = DB.__create_connection(self.__dbfile).cursor()
            else:
-                cursor = self.__cursor
-
-            DB.__log_and_execute(cursor, query, params)
+                cursor = self.__conn.cursor()
+            with cursor:
+                DB.__log_and_execute(cursor, query, params)


When login=True, a new connection is created but never explicitly closed, which could lead to resource leaks. The cursor context manager only closes the cursor, not the underlying connection. Consider storing the connection and ensuring it's properly closed, or restructure to reuse the existing connection.

Copilot · 2026-01-20T17:58:15Z

src/db.py

            if login:
                cursor = DB.__create_connection(self.__dbfile).cursor()
            else:
-                cursor = self.__cursor
-
-            DB.__log_and_execute(cursor, query, params)
-            return cursor.fetchall()
+                cursor = self.__conn.cursor()
+            with cursor:
+                DB.__log_and_execute(cursor, query, params)
+                return cursor.fetchall()


When login=True, a new connection is created but never explicitly closed, which could lead to resource leaks. The cursor context manager only closes the cursor, not the underlying connection. Consider storing the connection and ensuring it's properly closed, or restructure to reuse the existing connection.

PhBouzid · 2026-01-20T18:34:27Z

@copilot open a new pull request to apply changes based on the comments in this thread

Copilot · 2026-01-20T18:34:36Z

@PhBouzid I've opened a new pull request, #51, to work on those changes. Once the pull request is ready, I'll request review from you.

PhBouzid · 2026-01-20T18:37:45Z

I have read the CLA Document and I hereby sign the CLA

Co-authored-by: borislavr <noreply@github.com> Co-authored-by: Philipp Bouzid <ph.bouzid03@gmail.com>

Co-authored-by: NetcrackerCLPLCI <noreply@github.com>

Co-authored-by: borislavr <noreply@github.com> Co-authored-by: Philipp Bouzid <ph.bouzid03@gmail.com>

…ependencies (#48) Co-authored-by: borislavr <noreply@github.com>

…racker/qubership-backup-daemon into fix/resolve_vulnerabilities

fibu0125 added 3 commits March 11, 2025 18:23

add lock to the method log_and_execute

a069a33

create cursor every time when requested

d9a28fc

fix: resolve vulnerabilities

d7299ca

Copilot AI review requested due to automatic review settings January 20, 2026 17:54

Copilot started reviewing on behalf of PhBouzid January 20, 2026 17:55 View session

Copilot AI reviewed Jan 20, 2026

View reviewed changes

fibu0125 and others added 3 commits January 20, 2026 23:24

fix: update dependency

a799d6a

fix: one more updates for dependency

53d6be2

Merge branch 'main' into fix/resolve_vulnerabilities

117a750

github-actions bot added the bug Something isn't working label Jan 20, 2026

fix: resolve conflicts

907fe2f

Copilot AI mentioned this pull request Jan 20, 2026

Fix thread safety and resource leaks in DB class #51

Draft

fix: update requests dependency

3388520

NetcrackerCLPLCI and others added 4 commits January 20, 2026 23:50

fix(ci): fix for link-checker workflow [skip ci] (#44)

68a6b9b

Co-authored-by: borislavr <noreply@github.com> Co-authored-by: Philipp Bouzid <ph.bouzid03@gmail.com>

chore: update of common config files (#41)

67143f3

Co-authored-by: NetcrackerCLPLCI <noreply@github.com>

chore(ci): update of CLA workflow (#45)

c90a739

Co-authored-by: borislavr <noreply@github.com> Co-authored-by: Philipp Bouzid <ph.bouzid03@gmail.com>

feat(ci): add security-scan workflow to scan for vulnerabilities in d…

2f130f3

…ependencies (#48) Co-authored-by: borislavr <noreply@github.com>

github-actions bot added the enhancement New feature or request label Jan 20, 2026

fibu0125 added 8 commits January 21, 2026 00:05

fix: resolve checkov linter

440d7af

Merge branch 'fix/resolve_vulnerabilities' of https://github.com/Netc…

d196045

…racker/qubership-backup-daemon into fix/resolve_vulnerabilities

fix: resolve DOCKERFILE_HADOLINT

cb836ad

fix: resolve issue with builing dockerfile

fdd861a

fix: resolve PY_APSW_VER

1bbb291

fix: set no check cert

2b7441a

fix: build docker

9cdb59b

fix: return changes back

70f0cb0

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: resolve vulnerabilities#50

fix: resolve vulnerabilities#50
PhBouzid wants to merge 20 commits intomainfrom
fix/resolve_vulnerabilities

PhBouzid commented Jan 20, 2026

Uh oh!

github-actions bot commented Jan 20, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Jan 20, 2026

Uh oh!

Copilot AI Jan 20, 2026

Uh oh!

Copilot AI Jan 20, 2026

Uh oh!

Copilot AI Jan 20, 2026

Uh oh!

PhBouzid commented Jan 20, 2026

Uh oh!

Copilot AI commented Jan 20, 2026

Uh oh!

PhBouzid commented Jan 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

PhBouzid commented Jan 20, 2026

What type of PR is this? (check all applicable)

Description

Related Tickets & Documents

QA Instructions, Screenshots, Recordings

Breaking Change checklist

Added/updated tests?

[optional] Are there any things to highlight or double check?

[optional] What gif best describes this PR or how it makes you feel?

Uh oh!

github-actions bot commented Jan 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Jan 20, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 20, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 20, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 20, 2026

Choose a reason for hiding this comment

Uh oh!

PhBouzid commented Jan 20, 2026

Uh oh!

Copilot AI commented Jan 20, 2026

Uh oh!

PhBouzid commented Jan 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

github-actions bot commented Jan 20, 2026 •

edited

Loading