Skip to content

Commit 1e08132

Browse files
pcrespovpcrespov
authored
⬆️🔒️ Maintenance/vulnerability upgrade for ujson, upgrade fastapi+starlette (ITISFoundation#3112)
1 parent 988cc25 commit 1e08132

File tree

14 files changed

+109
-39
lines changed

14 files changed

+109
-39
lines changed

‎packages/service-library/requirements/_fastapi.txt‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ certifi==2022.6.15
1414
# httpx
1515
click==8.1.3
1616
# via uvicorn
17-
fastapi==0.82.0
17+
fastapi==0.85.0
1818
# via
1919
# -r requirements/_fastapi.in
2020
# fastapi-contrib
@@ -54,7 +54,7 @@ sniffio==1.3.0
5454
# anyio
5555
# httpcore
5656
# httpx
57-
starlette==0.19.1
57+
starlette==0.20.4
5858
# via fastapi
5959
threadloop==1.0.2
6060
# via jaeger-client

‎requirements/constraints.txt‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@ pyyaml>=5.4 # https://github.com/advisories/GH
1818
rsa>=4.1 # https://github.com/advisories/GHSA-537h-rv9q-vvph
1919
sqlalchemy[postgresql_psycopg2binary]>=1.3.3 # https://nvd.nist.gov/vuln/detail/CVE-2019-7164
2020
sqlalchemy>=1.3.3 # https://nvd.nist.gov/vuln/detail/CVE-2019-7164
21+
ujson>=5.4.0 # https://github.com/advisories/GHSA-fh56-85cw-5pq6, https://github.com/advisories/GHSA-wpqr-jcpx-745r
2122
urllib3>=1.26.5 # https://github.com/advisories/GHSA-q2q7-5pp4-w6pg
2223

2324
#

‎services/api-server/requirements/_base.txt‎

Lines changed: 17 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -95,7 +95,7 @@ email-validator==1.2.1
9595
# via
9696
# fastapi
9797
# pydantic
98-
fastapi==0.75.0
98+
fastapi==0.85.0
9999
# via
100100
# -r requirements/../../../packages/service-library/requirements/_fastapi.in
101101
# -r requirements/_base.in
@@ -285,7 +285,7 @@ sqlalchemy==1.4.37
285285
# -r requirements/../../../packages/simcore-sdk/requirements/../../../packages/postgres-database/requirements/_base.in
286286
# aiopg
287287
# alembic
288-
starlette==0.17.1
288+
starlette==0.20.4
289289
# via fastapi
290290
tenacity==8.0.1
291291
# via
@@ -317,8 +317,21 @@ typing-extensions==4.3.0
317317
# via
318318
# aiodebug
319319
# pydantic
320-
ujson==4.3.0
321-
# via fastapi
320+
# starlette
321+
ujson==5.5.0
322+
# via
323+
# -c requirements/../../../packages/models-library/requirements/../../../requirements/constraints.txt
324+
# -c requirements/../../../packages/postgres-database/requirements/../../../requirements/constraints.txt
325+
# -c requirements/../../../packages/service-library/requirements/../../../requirements/constraints.txt
326+
# -c requirements/../../../packages/service-library/requirements/./../../../requirements/constraints.txt
327+
# -c requirements/../../../packages/settings-library/requirements/../../../requirements/constraints.txt
328+
# -c requirements/../../../packages/simcore-sdk/requirements/../../../packages/models-library/requirements/../../../requirements/constraints.txt
329+
# -c requirements/../../../packages/simcore-sdk/requirements/../../../packages/postgres-database/requirements/../../../requirements/constraints.txt
330+
# -c requirements/../../../packages/simcore-sdk/requirements/../../../packages/service-library/requirements/../../../requirements/constraints.txt
331+
# -c requirements/../../../packages/simcore-sdk/requirements/../../../packages/settings-library/requirements/../../../requirements/constraints.txt
332+
# -c requirements/../../../packages/simcore-sdk/requirements/../../../requirements/constraints.txt
333+
# -c requirements/../../../requirements/constraints.txt
334+
# fastapi
322335
urllib3==1.26.9
323336
# via
324337
# -c requirements/../../../packages/models-library/requirements/../../../requirements/constraints.txt

‎services/api-server/tests/unit/test__fastapi.py‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -114,6 +114,9 @@ def test_fastapi_route_paths_in_paths(client: TestClient, faker: Faker):
114114

115115

116116
def test_fastapi_route_name_parsing(client: TestClient, faker: Faker):
117+
#
118+
# Ensures ':' is allowed in routes
119+
# SEE https://github.com/encode/starlette/pull/1657
117120

118121
solver_key = Solver.Config.schema_extra["example"]["id"]
119122
version = Solver.Config.schema_extra["example"]["version"]

‎services/autoscaling/requirements/_base.txt‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ dnspython==2.2.1
3333
# via email-validator
3434
email-validator==1.2.1
3535
# via pydantic
36-
fastapi==0.82.0
36+
fastapi==0.85.0
3737
# via
3838
# -r requirements/../../../packages/service-library/requirements/_fastapi.in
3939
# -r requirements/_base.in
@@ -114,7 +114,7 @@ sniffio==1.3.0
114114
# anyio
115115
# httpcore
116116
# httpx
117-
starlette==0.19.1
117+
starlette==0.20.4
118118
# via fastapi
119119
tenacity==8.0.1
120120
# via

‎services/catalog/requirements/_base.txt‎

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -51,7 +51,7 @@ email-validator==1.2.1
5151
# via
5252
# fastapi
5353
# pydantic
54-
fastapi==0.71.0
54+
fastapi==0.85.0
5555
# via
5656
# -r requirements/../../../packages/service-library/requirements/_fastapi.in
5757
# -r requirements/_base.in
@@ -191,7 +191,7 @@ sqlalchemy==1.4.37
191191
# -r requirements/../../../packages/postgres-database/requirements/_base.in
192192
# -r requirements/_base.in
193193
# alembic
194-
starlette==0.17.1
194+
starlette==0.20.4
195195
# via fastapi
196196
tenacity==8.0.1
197197
# via
@@ -217,8 +217,16 @@ typing-extensions==4.3.0
217217
# aiodebug
218218
# aioredis
219219
# pydantic
220-
ujson==4.3.0
221-
# via fastapi
220+
# starlette
221+
ujson==5.5.0
222+
# via
223+
# -c requirements/../../../packages/models-library/requirements/../../../requirements/constraints.txt
224+
# -c requirements/../../../packages/postgres-database/requirements/../../../requirements/constraints.txt
225+
# -c requirements/../../../packages/service-library/requirements/../../../requirements/constraints.txt
226+
# -c requirements/../../../packages/service-library/requirements/./../../../requirements/constraints.txt
227+
# -c requirements/../../../packages/settings-library/requirements/../../../requirements/constraints.txt
228+
# -c requirements/../../../requirements/constraints.txt
229+
# fastapi
222230
urllib3==1.26.9
223231
# via
224232
# -c requirements/../../../packages/models-library/requirements/../../../requirements/constraints.txt

‎services/datcore-adapter/requirements/_base.txt‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -54,7 +54,7 @@ ecdsa==0.14.1
5454
# via python-jose
5555
email-validator==1.2.1
5656
# via pydantic
57-
fastapi==0.75.1
57+
fastapi==0.85.0
5858
# via
5959
# -r requirements/../../../packages/service-library/requirements/_fastapi.in
6060
# -r requirements/_base.in
@@ -196,7 +196,7 @@ sniffio==1.2.0
196196
# anyio
197197
# httpcore
198198
# httpx
199-
starlette==0.17.1
199+
starlette==0.20.4
200200
# via fastapi
201201
tenacity==8.0.1
202202
# via
@@ -220,6 +220,7 @@ typing-extensions==4.3.0
220220
# via
221221
# aiodebug
222222
# pydantic
223+
# starlette
223224
urllib3==1.26.9
224225
# via
225226
# -c requirements/../../../packages/models-library/requirements/../../../requirements/constraints.txt

‎services/datcore-adapter/src/simcore_service_datcore_adapter/modules/remote_debug.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,4 +38,4 @@ def setup_remote_debugging(force_enabled=False, *, boot_mode=None):
3838
)
3939

4040

41-
__all__ = ["setup_remote_debugging"]
41+
__all__ = ("setup_remote_debugging",)

‎services/datcore-adapter/tests/unit/test_route_files.py‎

Lines changed: 15 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,9 @@
1-
# pylint:disable=unused-variable
2-
# pylint:disable=unused-argument
3-
# pylint:disable=redefined-outer-name
1+
# pylint: disable=redefined-outer-name
2+
# pylint: disable=unused-argument
3+
# pylint: disable=unused-variable
44

5-
from typing import Dict
5+
from typing import Iterator
6+
from unittest.mock import Mock
67

78
import httpx
89
import pytest
@@ -14,7 +15,9 @@
1415

1516

1617
@pytest.fixture
17-
async def pennsieve_files_mock(pennsieve_subsystem_mock, pennsieve_file_id: str):
18+
async def pennsieve_files_mock(
19+
pennsieve_subsystem_mock: Mock, pennsieve_file_id: str
20+
) -> Iterator[Mock]:
1821
mock = pennsieve_subsystem_mock
1922
if mock:
2023
FAKE_FILE_ID = "123434"
@@ -39,9 +42,9 @@ async def pennsieve_files_mock(pennsieve_subsystem_mock, pennsieve_file_id: str)
3942

4043
async def test_download_file_entrypoint(
4144
async_client: httpx.AsyncClient,
42-
pennsieve_subsystem_mock,
43-
pennsieve_files_mock,
44-
pennsieve_api_headers: Dict[str, str],
45+
pennsieve_subsystem_mock: Mock,
46+
pennsieve_files_mock: Mock,
47+
pennsieve_api_headers: dict[str, str],
4548
pennsieve_file_id: str,
4649
):
4750
file_id = pennsieve_file_id
@@ -57,9 +60,9 @@ async def test_download_file_entrypoint(
5760

5861
async def test_delete_file_entrypoint(
5962
async_client: httpx.AsyncClient,
60-
pennsieve_subsystem_mock,
61-
pennsieve_files_mock,
62-
pennsieve_api_headers: Dict[str, str],
63+
pennsieve_subsystem_mock: Mock,
64+
pennsieve_files_mock: Mock,
65+
pennsieve_api_headers: dict[str, str],
6366
pennsieve_file_id: str,
6467
):
6568
file_id = pennsieve_file_id
@@ -68,5 +71,4 @@ async def test_delete_file_entrypoint(
6871
headers=pennsieve_api_headers,
6972
)
7073
assert response.status_code == status.HTTP_204_NO_CONTENT
71-
data = response.json()
72-
assert not data
74+
assert response.num_bytes_downloaded == 0

‎services/director-v2/requirements/_base.txt‎

Lines changed: 19 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -121,7 +121,7 @@ email-validator==1.2.1
121121
# via
122122
# fastapi
123123
# pydantic
124-
fastapi==0.71.0
124+
fastapi==0.85.0
125125
# via
126126
# -r requirements/../../../packages/service-library/requirements/_fastapi.in
127127
# -r requirements/_base.in
@@ -370,7 +370,7 @@ sqlalchemy==1.4.37
370370
# -r requirements/../../../packages/simcore-sdk/requirements/../../../packages/postgres-database/requirements/_base.in
371371
# aiopg
372372
# alembic
373-
starlette==0.17.1
373+
starlette==0.20.4
374374
# via fastapi
375375
tblib==1.7.0
376376
# via
@@ -416,8 +416,23 @@ typing-extensions==4.3.0
416416
# aiodocker
417417
# aioredis
418418
# pydantic
419-
ujson==4.3.0
420-
# via fastapi
419+
# starlette
420+
ujson==5.5.0
421+
# via
422+
# -c requirements/../../../packages/dask-task-models-library/requirements/../../../packages/models-library/requirements/../../../requirements/constraints.txt
423+
# -c requirements/../../../packages/dask-task-models-library/requirements/../../../requirements/constraints.txt
424+
# -c requirements/../../../packages/models-library/requirements/../../../requirements/constraints.txt
425+
# -c requirements/../../../packages/postgres-database/requirements/../../../requirements/constraints.txt
426+
# -c requirements/../../../packages/service-library/requirements/../../../requirements/constraints.txt
427+
# -c requirements/../../../packages/service-library/requirements/./../../../requirements/constraints.txt
428+
# -c requirements/../../../packages/settings-library/requirements/../../../requirements/constraints.txt
429+
# -c requirements/../../../packages/simcore-sdk/requirements/../../../packages/models-library/requirements/../../../requirements/constraints.txt
430+
# -c requirements/../../../packages/simcore-sdk/requirements/../../../packages/postgres-database/requirements/../../../requirements/constraints.txt
431+
# -c requirements/../../../packages/simcore-sdk/requirements/../../../packages/service-library/requirements/../../../requirements/constraints.txt
432+
# -c requirements/../../../packages/simcore-sdk/requirements/../../../packages/settings-library/requirements/../../../requirements/constraints.txt
433+
# -c requirements/../../../packages/simcore-sdk/requirements/../../../requirements/constraints.txt
434+
# -c requirements/../../../requirements/constraints.txt
435+
# fastapi
421436
urllib3==1.26.9
422437
# via
423438
# -c requirements/../../../packages/dask-task-models-library/requirements/../../../packages/models-library/requirements/../../../requirements/constraints.txt

0 commit comments

Comments
 (0)