Skip to content

Commit 8dbb815

Browse files
erikboscherikbosch
committed
Fix aiohttp vulnerability
1 parent cf7e2ff commit 8dbb815

File tree

8 files changed

+144
-76
lines changed

8 files changed

+144
-76
lines changed

‎.project-creation/.skeleton/requirements.in‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,4 +15,4 @@
1515
grpcio==1.64.1
1616
protobuf==5.27.2
1717
cloudevents==1.11.0
18-
aiohttp==3.10.5
18+
aiohttp==3.10.11

‎.project-creation/.skeleton/requirements.txt‎

Lines changed: 12 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -4,35 +4,39 @@
44
#
55
# pip-compile
66
#
7-
aiohappyeyeballs==2.4.0
7+
aiohappyeyeballs==2.4.3
88
# via aiohttp
9-
aiohttp==3.10.5
9+
aiohttp==3.10.11
1010
# via -r requirements.in
1111
aiosignal==1.3.1
1212
# via aiohttp
13-
async-timeout==4.0.3
13+
async-timeout==5.0.1
1414
# via aiohttp
1515
attrs==24.2.0
1616
# via aiohttp
1717
cloudevents==1.11.0
1818
# via -r requirements.in
1919
deprecation==2.1.0
2020
# via cloudevents
21-
frozenlist==1.4.1
21+
frozenlist==1.5.0
2222
# via
2323
# aiohttp
2424
# aiosignal
2525
grpcio==1.64.1
2626
# via -r requirements.in
27-
idna==3.8
27+
idna==3.10
2828
# via yarl
29-
multidict==6.0.5
29+
multidict==6.1.0
3030
# via
3131
# aiohttp
3232
# yarl
33-
packaging==24.1
33+
packaging==24.2
3434
# via deprecation
35+
propcache==0.2.0
36+
# via yarl
3537
protobuf==5.27.2
3638
# via -r requirements.in
37-
yarl==1.9.7
39+
typing-extensions==4.12.2
40+
# via multidict
41+
yarl==1.17.2
3842
# via aiohttp

‎NOTICE-3RD-PARTY-CONTENT.md‎

Lines changed: 30 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -3,35 +3,35 @@
33
## Python
44
| Dependency | Version | License |
55
|:-----------|:-------:|--------:|
6-
|aiohappyeyeballs|2.4.0|Other/Proprietary License<br/>Python Software Foundation License|
7-
|aiohttp|3.10.5|Apache 2.0|
6+
|aiohappyeyeballs|2.4.3|Python Software Foundation License|
7+
|aiohttp|3.10.11|Apache 2.0|
88
|aiosignal|1.3.1|Apache 2.0|
99
|APScheduler|3.10.4|MIT|
10-
|async-timeout|4.0.3|Apache 2.0|
10+
|async-timeout|5.0.1|Apache 2.0|
1111
|attrs|24.2.0|MIT|
12-
|build|1.2.1|MIT|
12+
|build|1.2.2.post1|MIT|
1313
|cachetools|5.5.0|MIT|
1414
|cfgv|3.4.0|MIT|
1515
|chardet|5.2.0|LGPL|
1616
|click|8.1.7|New BSD|
1717
|cloudevents|1.11.0|Apache 2.0|
1818
|colorama|0.4.6|BSD|
19-
|coverage|7.6.1|Apache 2.0|
20-
|Deprecated|1.2.14|MIT|
19+
|coverage|7.6.7|Apache 2.0|
20+
|Deprecated|1.2.15|MIT|
2121
|deprecation|2.1.0|Apache 2.0|
22-
|distlib|0.3.8|Python Software Foundation License|
22+
|distlib|0.3.9|Python Software Foundation License|
2323
|exceptiongroup|1.2.2|MIT|
24-
|filelock|3.15.4|The Unlicense (Unlicense)|
25-
|frozenlist|1.4.1|Apache 2.0|
24+
|filelock|3.16.1|The Unlicense (Unlicense)|
25+
|frozenlist|1.5.0|Apache 2.0|
2626
|grpc-stubs|1.53.0.5|MIT|
2727
|grpcio|1.64.1|Apache 2.0|
2828
|grpcio-tools|1.64.1|Apache 2.0|
29-
|identify|2.6.0|MIT|
30-
|idna|3.8|BSD|
29+
|identify|2.6.2|MIT|
30+
|idna|3.10|BSD|
3131
|importlib-metadata|7.1.0|Apache 2.0|
3232
|iniconfig|2.0.0|MIT|
33-
|multidict|6.0.5|Apache 2.0|
34-
|mypy|1.11.2|MIT|
33+
|multidict|6.1.0|Apache 2.0|
34+
|mypy|1.13.0|MIT|
3535
|mypy-extensions|1.0.0|MIT|
3636
|mypy-protobuf|3.6.0|Apache 2.0|
3737
|nodeenv|1.9.1|BSD|
@@ -41,35 +41,36 @@
4141
|opentelemetry-instrumentation-logging|0.46b0|Apache 2.0|
4242
|opentelemetry-sdk|1.25.0|Apache 2.0|
4343
|opentelemetry-semantic-conventions|0.46b0|Apache 2.0|
44-
|packaging|24.1|Apache 2.0<br/>BSD|
44+
|packaging|24.2|Apache 2.0<br/>BSD|
4545
|paho-mqtt|2.1.0|OSI Approved|
4646
|pip|23.0.1|MIT|
4747
|pip-tools|7.4.1|BSD|
48-
|platformdirs|4.2.2|MIT|
48+
|platformdirs|4.3.6|MIT|
4949
|pluggy|1.5.0|MIT|
50-
|pre-commit|3.8.0|MIT|
50+
|pre-commit|4.0.1|MIT|
51+
|propcache|0.2.0|Apache 2.0|
5152
|protobuf|5.27.2|Google License|
52-
|pyproject-api|1.7.1|MIT|
53-
|pyproject-hooks|1.1.0|MIT|
54-
|pytest|8.3.2|MIT|
53+
|pyproject-api|1.8.0|MIT|
54+
|pyproject-hooks|1.2.0|MIT|
55+
|pytest|8.3.3|MIT|
5556
|pytest-asyncio|0.24.0|Apache 2.0|
56-
|pytest-cov|5.0.0|MIT|
57-
|pytz|2024.1|MIT|
57+
|pytest-cov|6.0.0|MIT|
58+
|pytz|2024.2|MIT|
5859
|PyYAML|6.0.2|MIT|
5960
|setuptools|65.5.1|MIT|
6061
|six|1.16.0|MIT|
61-
|tomli|2.0.1|MIT|
62-
|tox|4.18.0|MIT|
63-
|types-Deprecated|1.2.9.20240311|Apache 2.0|
62+
|tomli|2.1.0|MIT|
63+
|tox|4.23.2|MIT|
64+
|types-Deprecated|1.2.15.20241117|Apache 2.0|
6465
|types-mock|5.1.0.20240425|Apache 2.0|
65-
|types-protobuf|5.27.0.20240626|Apache 2.0|
66+
|types-protobuf|5.28.3.20241030|Apache 2.0|
6667
|typing-extensions|4.12.2|Python Software Foundation License|
6768
|tzlocal|5.2|MIT|
68-
|virtualenv|20.26.3|MIT|
69-
|wheel|0.44.0|MIT|
69+
|virtualenv|20.27.1|MIT|
70+
|wheel|0.45.0|MIT|
7071
|wrapt|1.16.0|BSD|
71-
|yarl|1.9.7|Apache 2.0|
72-
|zipp|3.20.1|MIT|
72+
|yarl|1.17.2|Apache 2.0|
73+
|zipp|3.21.0|MIT|
7374
## Workflows
7475
| Dependency | Version | License |
7576
|:-----------|:-------:|--------:|

‎README.md‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -63,3 +63,58 @@ By default the examples are started using the native middleware. Dapr middleware
6363
- [GitHub Issues](https://github.com/eclipse-velocitas/vehicle-app-python-sdk/issues)
6464
- [Mailing List](https://accounts.eclipse.org/mailing-list/velocitas-dev)
6565
- [Contribution](./CONTRIBUTING.md/)
66+
67+
### Creating a new release
68+
69+
The following actions are needed to create a release
70+
71+
1. Update `velocitas-sdk` version number in the following files
72+
73+
* `.project-creation/.skeleton/requirements-velocitas.txt`
74+
* `examples/seat-adjuster/requirements-velocitas.txt`
75+
76+
Use the version number intended for the release.
77+
It is no problem that the version does not yet exist as those files are not used
78+
in Continuous Integration.
79+
80+
2. Create a Pull Request and merge the updated version numbers
81+
3. Create PyPI and GitHub Release
82+
83+
Create a tag of the form `vX.Y.X` and upload to the repository.
84+
That will trigger the [release](https://github.com/eclipse-velocitas/vehicle-app-python-sdk/actions/workflows/release.yaml) workflow.
85+
If the action is successfully executed a new [GitHub release](https://github.com/eclipse-velocitas/vehicle-app-python-sdk/releases) shall have been created as well as as
86+
a new version of `velocitas-lib` published in [PyPI](https://pypi.org/project/velocitas-sdk/).
87+
88+
### Updating Dependencies
89+
90+
This repository specify exact Python versions in `setup.py` and other files.
91+
If a version needs to be updated, for example if a vulnerability is detected, the following approach needs to be followed
92+
93+
1. Update version in `setup.py` if needed
94+
2. Update generated requirement files.
95+
96+
```bash
97+
pip-compile -U --extra=dev
98+
```
99+
100+
3. Update version in `examples/seat-adjuster/requirements.in` if needed
101+
4. Update generated file for Seat Adjuster
102+
103+
```bash
104+
cd examples/seat-adjuster
105+
pip-compile -U
106+
```
107+
108+
5. Update version in `.project-creation/.skeleton/requirements.in` if needed
109+
6. Update generated file for Skeleton
110+
111+
```bash
112+
cd .project-creation/.skeleton/
113+
pip-compile -U
114+
```
115+
116+
7. Update `NOTICE-3RD-PARTY-CONTENT.md`
117+
118+
The easiest way to do it is to create a Pull Request.
119+
Then the [check license workflow](https://github.com/eclipse-velocitas/vehicle-app-python-sdk/actions/workflows/check-licenses.yml) will fail as versions used no longer match versions stated in the file.
120+
Copy output from the workflow to the `NOTICE-3RD-PARTY-CONTENT.md` file and update the Pull Request.

‎examples/seat-adjuster/requirements.in‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,5 +15,5 @@
1515
grpcio==1.64.1
1616
protobuf==5.27.2
1717
cloudevents==1.11.0
18-
aiohttp==3.10.5
18+
aiohttp==3.10.11
1919
packaging==24.1

‎examples/seat-adjuster/requirements.txt‎

Lines changed: 11 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -4,37 +4,41 @@
44
#
55
# pip-compile
66
#
7-
aiohappyeyeballs==2.4.0
7+
aiohappyeyeballs==2.4.3
88
# via aiohttp
9-
aiohttp==3.10.5
9+
aiohttp==3.10.11
1010
# via -r requirements.in
1111
aiosignal==1.3.1
1212
# via aiohttp
13-
async-timeout==4.0.3
13+
async-timeout==5.0.1
1414
# via aiohttp
1515
attrs==24.2.0
1616
# via aiohttp
1717
cloudevents==1.11.0
1818
# via -r requirements.in
1919
deprecation==2.1.0
2020
# via cloudevents
21-
frozenlist==1.4.1
21+
frozenlist==1.5.0
2222
# via
2323
# aiohttp
2424
# aiosignal
2525
grpcio==1.64.1
2626
# via -r requirements.in
27-
idna==3.8
27+
idna==3.10
2828
# via yarl
29-
multidict==6.0.5
29+
multidict==6.1.0
3030
# via
3131
# aiohttp
3232
# yarl
3333
packaging==24.1
3434
# via
3535
# -r requirements.in
3636
# deprecation
37+
propcache==0.2.0
38+
# via yarl
3739
protobuf==5.27.2
3840
# via -r requirements.in
39-
yarl==1.9.7
41+
typing-extensions==4.12.2
42+
# via multidict
43+
yarl==1.17.2
4044
# via aiohttp

0 commit comments

Comments
 (0)