Skip to content

Commit e8186e4

Browse files
kse3hikse3hi
authored
Fix security issues (#114)
* Fix security issues * Fix some issue in dependencies * Remove unecessary prints * Re-compiled requirements * Fix CI * Fix review findings
1 parent 2b5eb4b commit e8186e4

File tree

14 files changed

+89
-116
lines changed

14 files changed

+89
-116
lines changed

‎.github/actions/pre-commit-action/action.yml

Lines changed: 0 additions & 34 deletions
This file was deleted.

‎.github/workflows/ci.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ jobs:
3535
strategy:
3636
max-parallel: 3
3737
matrix:
38-
python-version: [3.8, 3.9, "3.10"]
38+
python-version: ["3.9", "3.10"]
3939

4040
steps:
4141
- name: Checkout repository
@@ -57,7 +57,7 @@ jobs:
5757
python3 -m pip install tox-gh-actions
5858
5959
- name: Run Linters
60-
uses: ./.github/actions/pre-commit-action
60+
uses: pre-commit/action@v3.0.0
6161

6262
- name: Run the daparized databroker binary
6363
run: |

‎.project-creation/.skeleton/requirements.in

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,3 +16,4 @@ grpcio==1.59.0
1616
protobuf==4.24.4
1717
dapr==1.11.0
1818
cloudevents==1.10.0
19+
aiohttp==3.9.2

‎.project-creation/.skeleton/requirements.txt

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4,16 +4,16 @@
44
#
55
# pip-compile requirements.in
66
#
7-
aiohttp==3.8.6
8-
# via dapr
7+
aiohttp==3.9.0
8+
# via
9+
# -r requirements.in
10+
# dapr
911
aiosignal==1.3.1
1012
# via aiohttp
1113
async-timeout==4.0.3
1214
# via aiohttp
1315
attrs==23.1.0
1416
# via aiohttp
15-
charset-normalizer==3.3.0
16-
# via aiohttp
1717
cloudevents==1.10.0
1818
# via -r requirements.in
1919
dapr==1.11.0

‎.project-creation/run.py

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -81,7 +81,7 @@ def compile_requirements(destination_repo: str) -> None:
8181

8282
subprocess.check_call( # nosec B603, B607
8383
["python", "-m", "piptools", "compile"],
84-
cwd=destination_repo,
84+
cwd=os.path.join(destination_repo),
8585
stdout=subprocess.DEVNULL,
8686
stderr=subprocess.DEVNULL,
8787
)
@@ -113,6 +113,7 @@ def main():
113113
if args.example
114114
else os.path.join(get_repo_root(), ".project-creation", ".skeleton")
115115
)
116+
116117
copy_project(example_app, args.destination)
117118

118119
compile_requirements(args.destination)

‎.project-creation/templates/requirements.in

Lines changed: 3 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -21,11 +21,8 @@
2121
# Development Tools Packages
2222
##########################################
2323
grpcio-tools==1.59.0
24-
grpc-stubs==1.53.0.2
24+
grpc-stubs==1.53.0.5
2525
mypy-protobuf==3.5.0
26-
pre-commit==3.3.3
27-
black==23.7.0
28-
mypy==1.5.1
29-
bandit==1.7.5
30-
flake8==6.1.0
26+
pre-commit==3.6.0
27+
mypy==1.8.0
3128
pip-tools==7.3.0

‎NOTICE-3RD-PARTY-CONTENT.md

Lines changed: 23 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -3,35 +3,34 @@
33
## Python
44
| Dependency | Version | License |
55
|:-----------|:-------:|--------:|
6-
|aiohttp|3.8.5|Apache 2.0|
6+
|aiohttp|3.9.2|Apache 2.0|
77
|aiosignal|1.3.1|Apache 2.0|
88
|APScheduler|3.10.4|MIT|
99
|async-timeout|4.0.3|Apache 2.0|
1010
|attrs|23.1.0|MIT|
1111
|build|1.0.3|MIT|
12-
|cachetools|5.3.1|MIT|
12+
|cachetools|5.3.2|MIT|
1313
|cfgv|3.4.0|MIT|
1414
|chardet|5.2.0|LGPL|
15-
|charset-normalizer|3.2.0|MIT|
1615
|click|8.1.7|New BSD|
1716
|cloudevents|1.9.0|Apache 2.0|
1817
|colorama|0.4.6|BSD|
19-
|coverage|7.3.2|Apache 2.0|
18+
|coverage|7.4.1|Apache 2.0|
2019
|dapr|1.10.0|Apache 2.0|
2120
|Deprecated|1.2.14|MIT|
2221
|deprecation|2.1.0|Apache 2.0|
23-
|distlib|0.3.7|Python Software Foundation License|
24-
|exceptiongroup|1.1.3|MIT|
25-
|filelock|3.12.4|The Unlicense (Unlicense)|
22+
|distlib|0.3.8|Python Software Foundation License|
23+
|exceptiongroup|1.2.0|MIT|
24+
|filelock|3.13.1|The Unlicense (Unlicense)|
2625
|frozenlist|1.4.0|Apache 2.0|
27-
|grpc-stubs|1.53.0.3|MIT|
26+
|grpc-stubs|1.53.0.5|MIT|
2827
|grpcio|1.59.0|Apache 2.0|
2928
|grpcio-tools|1.59.0|Apache 2.0|
30-
|identify|2.5.30|MIT|
29+
|identify|2.5.33|MIT|
3130
|idna|3.4|BSD|
3231
|iniconfig|2.0.0|MIT|
3332
|multidict|6.0.4|Apache 2.0|
34-
|mypy|1.6.0|MIT|
33+
|mypy|1.8.0|MIT|
3534
|mypy-extensions|1.0.0|MIT|
3635
|mypy-protobuf|3.4.0|Apache 2.0|
3736
|nodeenv|1.8.0|BSD|
@@ -45,29 +44,29 @@
4544
|paho-mqtt|1.6.1|OSI Approved|
4645
|pip|23.3.2|MIT|
4746
|pip-tools|7.3.0|BSD|
48-
|platformdirs|3.11.0|MIT|
49-
|pluggy|1.3.0|MIT|
50-
|pre-commit|3.4.0|MIT|
47+
|platformdirs|4.1.0|MIT|
48+
|pluggy|1.4.0|MIT|
49+
|pre-commit|3.6.0|MIT|
5150
|protobuf|4.21.12|Google License|
5251
|pyproject-api|1.6.1|MIT|
5352
|pyproject-hooks|1.0.0|MIT|
54-
|pytest|7.4.2|MIT|
55-
|pytest-asyncio|0.21.1|Apache 2.0|
53+
|pytest|7.4.4|MIT|
54+
|pytest-asyncio|0.23.4|Apache 2.0|
5655
|pytest-cov|4.1.0|MIT|
5756
|python-dateutil|2.8.2|Apache 2.0<br/>BSD|
58-
|pytz|2023.3.post1|MIT|
57+
|pytz|2023.4|MIT|
5958
|PyYAML|6.0.1|MIT|
6059
|setuptools|58.1.0|MIT|
6160
|six|1.16.0|MIT|
6261
|tomli|2.0.1|MIT|
63-
|tox|4.11.3|MIT|
64-
|types-Deprecated|1.2.9.3|Apache 2.0|
65-
|types-mock|5.1.0.2|Apache 2.0|
66-
|types-protobuf|4.24.0.2|Apache 2.0|
62+
|tox|4.11.4|MIT|
63+
|types-Deprecated|1.2.9.20240106|Apache 2.0|
64+
|types-mock|5.1.0.20240106|Apache 2.0|
65+
|types-protobuf|4.24.0.20240106|Apache 2.0|
6766
|typing-extensions|4.7.1|Python Software Foundation License|
68-
|tzlocal|5.1|MIT|
69-
|virtualenv|20.24.5|MIT|
70-
|wheel|0.41.2|MIT|
67+
|tzlocal|5.2|MIT|
68+
|virtualenv|20.25.0|MIT|
69+
|wheel|0.42.0|MIT|
7170
|wrapt|1.15.0|BSD|
7271
|yarl|1.9.2|Apache 2.0|
7372
## Workflows
@@ -82,4 +81,5 @@
8281
|devcontainers/ci|v0.3|MIT License|
8382
|github/codeql-action|v2|MIT License|
8483
|mikepenz/action-junit-report|v4|Apache License 2.0|
84+
|pre-commit/action|v3.0.0|MIT License|
8585
|softprops/action-gh-release|v1|MIT License|

‎examples/seat-adjuster/requirements.in

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,3 +16,5 @@ grpcio==1.59.0
1616
protobuf==4.24.4
1717
dapr==1.11.0
1818
cloudevents==1.10.0
19+
aiohttp==3.9.2
20+
packaging==23.0

‎examples/seat-adjuster/requirements.txt

Lines changed: 11 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -4,23 +4,23 @@
44
#
55
# pip-compile
66
#
7-
aiohttp==3.8.3
8-
# via dapr
7+
aiohttp==3.9.2
8+
# via
9+
# -r requirements.in
10+
# dapr
911
aiosignal==1.3.1
1012
# via aiohttp
11-
async-timeout==4.0.2
13+
async-timeout==4.0.3
1214
# via aiohttp
13-
attrs==22.2.0
14-
# via aiohttp
15-
charset-normalizer==2.1.1
15+
attrs==23.1.0
1616
# via aiohttp
1717
cloudevents==1.10.0
1818
# via -r requirements.in
1919
dapr==1.11.0
2020
# via -r requirements.in
2121
deprecation==2.1.0
2222
# via cloudevents
23-
frozenlist==1.3.3
23+
frozenlist==1.4.0
2424
# via
2525
# aiohttp
2626
# aiosignal
@@ -35,7 +35,9 @@ multidict==6.0.4
3535
# aiohttp
3636
# yarl
3737
packaging==23.0
38-
# via deprecation
38+
# via
39+
# -r requirements.in
40+
# deprecation
3941
protobuf==4.24.4
4042
# via
4143
# -r requirements.in
@@ -46,5 +48,5 @@ six==1.16.0
4648
# via python-dateutil
4749
typing-extensions==4.8.0
4850
# via dapr
49-
yarl==1.8.2
51+
yarl==1.9.2
5052
# via aiohttp

‎examples/seat-adjuster/tests/requirements.in

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,3 +17,4 @@ pytest-ordering
1717
pytest-asyncio
1818
pytest-cov
1919
types-mock
20+
packaging==23.0

0 commit comments

Comments
 (0)