update stac, weaver, magpie, twitcher, cowbird - security fixes for EOL Python and http-related libraires (#622)

## Overview

Update multiple components with corresponding updates of `urllib`,
`requests`, etc.
At the same time, bump to Python 3.13 versions as applicable.

## Changes

**Non-breaking changes**
- STAC API: Security update, minor OpenAPI version reporting fixes, and
`stac-fastapi`/`starlette` compatibility fix using
[2.3.0](https://github.com/crim-ca/stac-app/releases/tag/2.3.0)
   - relates to crim-ca/stac-app#65
   - relates to crim-ca/stac-app#69
   - relates to crim-ca/stac-app#74

- Cowbird: Security update to version
[2.6.0](https://github.com/Ouranosinc/cowbird/releases/tag/2.6.0)
  - relates to Ouranosinc/cowbird#98

- Magpie: Security update to version
[4.3.0](https://github.com/Ouranosinc/Magpie/releases/tag/4.3.0)
  - relates to Ouranosinc/Magpie#640
  - relates to Ouranosinc/Magpie#642

- Twitcher: Security update to version
[0.11.0](https://github.com/bird-house/twitcher/releases/tag/v0.11.0)
  - relates to bird-house/twitcher#143
  - relates to bird-house/twitcher#145
  - relates to bird-house/twitcher#146
  - relates to bird-house/twitcher#148

- Weaver: Security and dependency fix update using version
[6.8.3](https://github.com/crim-ca/weaver/releases/tag/6.8.3)
  - relates to crim-ca/weaver#868
  - relates to crim-ca/weaver#869
  - relates to crim-ca/weaver#877
  - relates to crim-ca/weaver#881

- Weaver: Update `post-docker-compose-up` script.
  - Handle multiple Magpie cookies in response.
This can happen depending on specific internal HTTP libraries versions
of the services.
To retain backward/forward compatibility, all cookies returned from
Magpie are chained in following `curl` commands.
- Use birdhouse `log` utility to report operations produced by the
script rather than custom "echo level".

- Weaver: Job Result Proxy Buffers
- The *Job Results* responses of `weaver` can return a lot of `Link`
headers. This is done to provide job metadata
references and provenance traceability details, but also for actual
results locations that can vary in quantity
    depending on the actual process execution.
Therefore, the Ngnix `proxy_buffer_size` and `proxy_buffers` directives
of the `proxy` service must be added with
sufficiently large values to avoid HTTP 502 errors when the response
headers exceed the default buffer sizes.
The `WEAVER_PROXY_RESPONSE_BUFFER_SIZE` and
`WEAVER_PROXY_RESPONSE_BUFFER_COUNT` variables are added to allow
further customization as needed by the server. Their defaults are
reasonable values to meet minimal requirements
    by `weaver`'s metadata `Link` and a few result outputs.

- Birdhouse: Allow `log <LEVEL> -n ...` and `log <LEVEL> -p ...` to
generate log outputs without newline/prefixes.

These options allow writing multiple log entries onto the same line for
correct visual rendering of distinct `log`
calls separated to allow some intermediate logic. The `log` function
invocations with these options respect the
log levels in order to make the messages consistent with enabled
redirections and verbosity.

**Breaking changes**
- n/a

Author: fmigneault

.bumpversion.toml

@@ -1,5 +1,5 @@
 [tool.bumpversion]
-current_version = "2.23.0"
+current_version = "2.23.1"
 commit = true
 message = "Bump version: {current_version} → {new_version} [skip ci]"
 tag = false

CHANGES.md

@@ -17,6 +17,58 @@
 
 [//]: # (list changes here, using '-' for each new entry, remove this when items are added)
 
+[2.23.1](https://github.com/bird-house/birdhouse-deploy/tree/2.23.1) (2026-02-17)
+------------------------------------------------------------------------------------------------------------------
+
+## Changes
+
+- STAC API: Security update, minor OpenAPI version reporting fixes, and `stac-fastapi`/`starlette` compatibility fix
+  using version [2.3.0](https://github.com/crim-ca/stac-app/releases/tag/2.3.0)
+  (relates to [crim-ca/stac-app#65](https://github.com/crim-ca/stac-app/pull/65),
+  [crim-ca/stac-app#69](https://github.com/crim-ca/stac-app/pull/69) and
+  [crim-ca/stac-app#74](https://github.com/crim-ca/stac-app/pull/74)).
+
+- Cowbird: Security update using version [2.6.0](https://github.com/Ouranosinc/cowbird/releases/tag/2.6.0)
+  (relates to [Ouranosinc/cowbird#98](https://github.com/Ouranosinc/cowbird/pull/98)).
+
+- Magpie: Security update using version [4.3.1](https://github.com/Ouranosinc/Magpie/releases/tag/4.3.1)
+  (relates to [Ouranosinc/Magpie#640](https://github.com/Ouranosinc/Magpie/pull/640)
+  and [Ouranosinc/Magpie#642](https://github.com/Ouranosinc/Magpie/pull/642)).
+
+- Twitcher: Security update using version [0.11.0](https://github.com/bird-house/twitcher/releases/tag/v0.11.0)
+  (relates to [bird-house/twitcher#143](https://github.com/bird-house/twitcher/pull/143),
+  [bird-house/twitcher#145](https://github.com/bird-house/twitcher/pull/145),
+  [bird-house/twitcher#146](https://github.com/bird-house/twitcher/pull/146) and
+  [bird-house/twitcher#148](https://github.com/bird-house/twitcher/pull/148)).
+
+- Weaver: Security and dependency fix update using version [6.8.3](https://github.com/crim-ca/weaver/releases/tag/6.8.3)
+  (relates to [crim-ca/weaver#868](https://github.com/crim-ca/weaver/pull/868),
+  [crim-ca/weaver#869](https://github.com/crim-ca/weaver/pull/869),
+  [crim-ca/weaver#877](https://github.com/crim-ca/weaver/pull/877) and
+  [crim-ca/weaver#881](https://github.com/crim-ca/weaver/pull/881)).
+
+- Weaver: Update `post-docker-compose-up` script.
+  - Handle multiple Magpie cookies in response.
+    This can happen depending on specific internal HTTP libraries versions of the services.
+    To retain backward/forward compatibility, all cookies returned from Magpie are chained in following `curl` commands.
+  - Use birdhouse `log` utility to report operations produced by the script rather than custom "echo level".
+
+- Weaver: Job Result Proxy Buffers
+  - The *Job Results* responses of `weaver` can return a lot of `Link` headers. This is done to provide job metadata
+    references and provenance traceability details, but also for actual results locations that can vary in quantity
+    depending on the actual process execution.
+    Therefore, the Ngnix `proxy_buffer_size` and `proxy_buffers` directives of the `proxy` service must be added with
+    sufficiently large values to avoid HTTP 502 errors when the response headers exceed the default buffer sizes.
+    The `WEAVER_PROXY_RESPONSE_BUFFER_SIZE` and `WEAVER_PROXY_RESPONSE_BUFFER_COUNT` variables are added to allow
+    further customization as needed by the server. Their defaults are reasonable values to meet minimal requirements
+    by `weaver`'s metadata `Link` and a few result outputs.
+
+- Birdhouse: Allow `log <LEVEL> -n ...` and `log <LEVEL> -p ...` to generate log outputs without newline/prefixes.
+  
+  These options allow writing multiple log entries onto the same line for correct visual rendering of distinct `log`
+  calls separated to allow some intermediate logic. The `log` function invocations with these options respect the
+  log levels in order to make the messages consistent with enabled redirections and verbosity.
+
 [2.23.0](https://github.com/bird-house/birdhouse-deploy/tree/2.23.0) (2026-02-13)
 ------------------------------------------------------------------------------------------------------------------
 

Makefile

@@ -8,7 +8,7 @@ override BIRDHOUSE_MAKE_DIR := $(shell realpath -P $$(dirname $(BIRDHOUSE_MAKE_C
 # Generic variables
 override SHELL       := bash
 override APP_NAME    := birdhouse-deploy
-override APP_VERSION := 2.23.0
+override APP_VERSION := 2.23.1
 
 # utility to remove comments after value of an option variable
 override clean_opt = $(shell echo "$(1)" | $(_SED) -r -e "s/[ '$'\t'']+$$//g")

README.rst

@@ -18,13 +18,13 @@ for a full-fledged production platform.
     * - citation
       - | |citation|
 
-.. |commits-since| image:: https://img.shields.io/github/commits-since/bird-house/birdhouse-deploy/2.23.0.svg
+.. |commits-since| image:: https://img.shields.io/github/commits-since/bird-house/birdhouse-deploy/2.23.1.svg
     :alt: Commits since latest release
-    :target: https://github.com/bird-house/birdhouse-deploy/compare/2.23.0...master
+    :target: https://github.com/bird-house/birdhouse-deploy/compare/2.23.1...master
 
-.. |latest-version| image:: https://img.shields.io/badge/tag-2.23.0-blue.svg?style=flat
+.. |latest-version| image:: https://img.shields.io/badge/tag-2.23.1-blue.svg?style=flat
     :alt: Latest Tag
-    :target: https://github.com/bird-house/birdhouse-deploy/tree/2.23.0
+    :target: https://github.com/bird-house/birdhouse-deploy/tree/2.23.1
 
 .. |readthedocs| image:: https://readthedocs.org/projects/birdhouse-deploy/badge/?version=latest
     :alt: ReadTheDocs Build Status (latest version)

RELEASE.txt

@@ -1 +1 @@
-2.23.0 2026-02-13T00:28:48Z
+2.23.1 2026-02-17T22:14:37Z

bin/birdhouse

@@ -228,7 +228,7 @@ print_config_command() {
 }
 
 print_log_command() {
-  echo ". ${COMPOSE_DIR}/scripts/logging.include.sh"
+  echo "export __BIRDHOUSE_SUPPORTED_INTERFACE=True ; . ${COMPOSE_DIR}/scripts/logging.include.sh"
 }
 
 # Support multiple short flags together (ex: -abc instead of -a -b -c)

birdhouse/components/README.rst

@@ -13,7 +13,7 @@ service but this runs in docker containers and is specifically designed to inter
 Birdhouse stack.
 
 Available jobs
--------------
+--------------
 
 Scheduler jobs can be enabled by enabling optional components. Birdhouse comes with a variety of
 these jobs in the ``optional-components`` directory. To enable any of these jobs, add the relevant
@@ -623,6 +623,29 @@ Customizing the Component
     entirely, the ``WEAVER_ALT_PREFIX`` variable should be explicitly set to an empty value.
 
 
+Managing Large Job Results
+--------------------------
+
+The `Job Results <https://pavics-weaver.readthedocs.io/en/latest/processes.html#job-results>`_ responses from `Weaver`
+can return a lot of ``Link`` headers. This is done to provide job metadata references and provenance traceability
+details, but also for actual results locations that can vary in quantity depending on the actual process execution.
+
+By default, the Ngnix `proxy_buffer_size <https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_buffer_size>`_
+and `proxy_buffers <https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_buffers>`_ directives of
+the ``proxy`` service are added to the `Weaver` API endpoints with sufficiently large values to avoid HTTP 502 errors
+when the response headers exceed the default buffer sizes.
+
+If your processes happen to generate even larger results (e.g.: they return many NetCDF files from batch processing),
+you may need to further increase these buffer sizes using
+the ``WEAVER_PROXY_RESPONSE_BUFFER_SIZE`` and ``WEAVER_PROXY_RESPONSE_BUFFER_COUNT`` variables.
+
+If your processes generate a *very large* number of results, you may also want to consider
+alternate *content negotiation strategies* as described in
+the `Job Results <https://pavics-weaver.readthedocs.io/en/latest/processes.html#job-results>`_
+and `Process Execution Results <https://pavics-weaver.readthedocs.io/en/latest/processes.html#proc-exec-results>`_
+sections of the `Weaver` documentation. Certain execution request parameters can be explicitly provided to limit
+the number of returned headers and their representation in the responses.
+
 .. _finch: https://github.com/bird-house/finch
 .. _flyingpigeon: https://github.com/bird-house/flyingpigeon
 .. _Weaver: https://github.com/crim-ca/weaver

birdhouse/components/canarie-api/docker_configuration.py.template

@@ -108,8 +108,8 @@ SERVICES = {
             # NOTE:
             #   Below version and release time auto-managed by 'make VERSION=x.y.z bump'.
             #   Do NOT modify it manually. See 'Tagging policy' in 'birdhouse/README.rst'.
-            'version': '2.23.0',
-            'releaseTime': '2026-02-13T00:28:48Z',
+            'version': '2.23.1',
+            'releaseTime': '2026-02-17T22:14:37Z',
             'institution': '${BIRDHOUSE_INSTITUTION}',
             'researchSubject': '${BIRDHOUSE_SUBJECT}',
             'supportEmail': '${BIRDHOUSE_SUPPORT_EMAIL}',
@@ -141,8 +141,8 @@ PLATFORMS = {
             # NOTE:
             #   Below version and release time auto-managed by 'make VERSION=x.y.z bump'.
             #   Do NOT modify it manually. See 'Tagging policy' in 'birdhouse/README.rst'.
-            'version': '2.23.0',
-            'releaseTime': '2026-02-13T00:28:48Z',
+            'version': '2.23.1',
+            'releaseTime': '2026-02-17T22:14:37Z',
             'institution': '${BIRDHOUSE_INSTITUTION}',
             'researchSubject': '${BIRDHOUSE_SUBJECT}',
             'supportEmail': '${BIRDHOUSE_SUPPORT_EMAIL}',

birdhouse/components/cowbird/default.env

@@ -29,7 +29,7 @@ VARS="$VARS $EXTRA_VARS"
 # Cowbird Configuration
 # =====================
 
-export COWBIRD_VERSION="2.5.2"
+export COWBIRD_VERSION="2.6.0"
 export COWBIRD_DOCKER=pavics/cowbird
 export COWBIRD_IMAGE='${COWBIRD_DOCKER}:${COWBIRD_VERSION}'
 export COWBIRD_IMAGE_API='${COWBIRD_IMAGE}-webservice'

birdhouse/components/magpie/default.env

@@ -5,7 +5,7 @@
 # are applied and must be added to the list of DELAYED_EVAL.
 
 # Tag version that will be used to update Magpie API, Magpie CLI, and matching Twitcher with Magpie Adapter
-export MAGPIE_VERSION=4.2.0
+export MAGPIE_VERSION=4.3.1
 export MAGPIE_IMAGE='pavics/magpie:${MAGPIE_VERSION}'
 export MAGPIE_IMAGE_URI='registry.hub.docker.com/${MAGPIE_IMAGE}'