Skip to content

Security/640 resolve vulnerability with pip #641

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ArBridgeman merged 4 commits into from
Oct 30, 2025
Merged

Security/640 resolve vulnerability with pip #641

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
f994f0f
Re-lock dependencies to resolve CVE-2025-8869 for transitive dependen…
ArBridgeman Oct 30, 2025
0d805bd
Update workflows to PTB 1.12.0
ArBridgeman Oct 30, 2025
dcccd0c
Use BaseConfig for Config from PTB 1.12.0
ArBridgeman Oct 30, 2025
33993b5
Reverse pytest from 8.4.2 to 7.4.4 as leads to uses with test:sqla
ArBridgeman Oct 30, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/build-and-publish.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ jobs:
contents: write
steps:
- name: SCM Checkout
uses: actions/checkout@v4
uses: actions/checkout@v5
Copy link
Copy Markdown
Collaborator Author

@ArBridgeman ArBridgeman Oct 30, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

workflow updates are triggered by poetry run -- tbx workflow update and are hand-checked that custom functionality was not lost


- name: Setup Python & Poetry Environment
uses: exasol/python-toolbox/.github/actions/python-environment@v1
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/check-release-tag.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ jobs:
contents: read
steps:
- name: SCM Checkout
uses: actions/checkout@v4
uses: actions/checkout@v5

- name: Setup Python & Poetry Environment
uses: exasol/python-toolbox/.github/actions/python-environment@v1
Expand Down
40 changes: 28 additions & 12 deletions .github/workflows/checks.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ jobs:
contents: read
steps:
- name: SCM Checkout
uses: actions/checkout@v4
uses: actions/checkout@v5
with:
fetch-depth: 0

Expand All @@ -29,7 +29,7 @@ jobs:
contents: read
steps:
- name: SCM Checkout
uses: actions/checkout@v4
uses: actions/checkout@v5

- name: Setup Python & Poetry Environment
uses: exasol/python-toolbox/.github/actions/python-environment@v1
Expand All @@ -56,7 +56,7 @@ jobs:
if: ${{ github.ref != 'refs/heads/main' && github.ref != 'refs/heads/master' }}
steps:
- name: SCM Checkout
uses: actions/checkout@v4
uses: actions/checkout@v5

- name: Setup Python & Poetry Environment
uses: exasol/python-toolbox/.github/actions/python-environment@v1
Expand All @@ -75,7 +75,7 @@ jobs:
matrix: ${{ fromJson(needs.build-matrix.outputs.matrix) }}
steps:
- name: SCM Checkout
uses: actions/checkout@v4
uses: actions/checkout@v5

- name: Setup Python & Poetry Environment
uses: exasol/python-toolbox/.github/actions/python-environment@v1
Expand All @@ -86,7 +86,7 @@ jobs:
run: poetry run -- nox -s lint:code

- name: Upload Artifacts
uses: actions/upload-artifact@v4.6.2
uses: actions/upload-artifact@v5
with:
name: lint-python${{ matrix.python-version }}
path: |
Expand All @@ -106,7 +106,7 @@ jobs:

steps:
- name: SCM Checkout
uses: actions/checkout@v4
uses: actions/checkout@v5

- name: Setup Python & Poetry Environment
uses: exasol/python-toolbox/.github/actions/python-environment@v1
Expand All @@ -128,7 +128,7 @@ jobs:

steps:
- name: SCM Checkout
uses: actions/checkout@v4
uses: actions/checkout@v5

- name: Setup Python & Poetry Environment
uses: exasol/python-toolbox/.github/actions/python-environment@v1
Expand All @@ -139,7 +139,7 @@ jobs:
run: poetry run -- nox -s lint:security

- name: Upload Artifacts
uses: actions/upload-artifact@v4.6.2
uses: actions/upload-artifact@v5
with:
name: security-python${{ matrix.python-version }}
path: .security.json
Expand All @@ -152,17 +152,33 @@ jobs:
contents: read
steps:
- name: SCM Checkout
uses: actions/checkout@v4
uses: actions/checkout@v5

- name: Setup Python & Poetry Environment
uses: exasol/python-toolbox/.github/actions/python-environment@v1

- name: Run format check
run: poetry run -- nox -s project:format

Build-Packages:
name: Build Package Check
needs: [ Documentation, Lint, Type-Check, Security, Format ]
runs-on: ubuntu-24.04
permissions:
contents: read
steps:
- name: SCM Checkout
uses: actions/checkout@v5

- name: Setup Python & Poetry Environment
uses: exasol/python-toolbox/.github/actions/python-environment@v1

- name: Run Distribution Check
run: poetry run -- nox -s package:check

Tests:
name: Unit-Tests (Python-${{ matrix.python-version }})
needs: [ Documentation, Lint, Type-Check, Security, Format, build-matrix ]
needs: [ Build-Packages, build-matrix ]
runs-on: ubuntu-24.04
permissions:
contents: read
Expand All @@ -172,7 +188,7 @@ jobs:

steps:
- name: SCM Checkout
uses: actions/checkout@v4
uses: actions/checkout@v5

- name: Setup Python & Poetry Environment
uses: exasol/python-toolbox/.github/actions/python-environment@v1
Expand All @@ -185,7 +201,7 @@ jobs:
poetry run -- nox -s test:unit -- --coverage

- name: Upload Artifacts
uses: actions/upload-artifact@v4.6.2
uses: actions/upload-artifact@v5
with:
name: coverage-python${{ matrix.python-version }}-fast
path: .coverage
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/gh-pages.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ jobs:
contents: read
steps:
- name: SCM Checkout
uses: actions/checkout@v4
uses: actions/checkout@v5
with:
fetch-depth: 0

Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/matrix-all.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ jobs:
contents: read
steps:
- name: SCM Checkout
uses: actions/checkout@v4
uses: actions/checkout@v5

- name: Setup Python & Poetry Environment
uses: exasol/python-toolbox/.github/actions/python-environment@v1
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/matrix-exasol.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ jobs:
contents: read
steps:
- name: SCM Checkout
uses: actions/checkout@v4
uses: actions/checkout@v5

- name: Setup Python & Poetry Environment
uses: exasol/python-toolbox/.github/actions/python-environment@v1
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/matrix-python.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ jobs:
contents: read
steps:
- name: SCM Checkout
uses: actions/checkout@v4
uses: actions/checkout@v5

- name: Setup Python & Poetry Environment
uses: exasol/python-toolbox/.github/actions/python-environment@v1
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/report.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,15 +14,15 @@ jobs:

steps:
- name: SCM Checkout
uses: actions/checkout@v4
uses: actions/checkout@v5
with:
fetch-depth: 0

- name: Setup Python & Poetry Environment
uses: exasol/python-toolbox/.github/actions/python-environment@v1

- name: Download Artifacts
uses: actions/download-artifact@v5.0.0
uses: actions/download-artifact@v6
with:
path: ./artifacts

Expand All @@ -41,7 +41,7 @@ jobs:
run: poetry run -- nox -s project:report -- --format json | tee metrics.json

- name: Upload Artifacts
uses: actions/upload-artifact@v4.6.2
uses: actions/upload-artifact@v5
with:
name: metrics.json
path: metrics.json
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/slow-checks.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ jobs:
permissions:
contents: read

Tests:
tests:
name: Integration-Tests (${{matrix.connector}}, Python-${{ matrix.python-version }}, Exasol-${{ matrix.exasol-version}})
needs: [ build-matrix ]
runs-on: ubuntu-24.04
Expand All @@ -24,7 +24,7 @@ jobs:

steps:
- name: SCM Checkout
uses: actions/checkout@v4
uses: actions/checkout@v5

- name: Setup Python & Poetry Environment
uses: exasol/python-toolbox/.github/actions/python-environment@v1
Expand All @@ -40,7 +40,7 @@ jobs:
poetry run -- nox -s test:integration -- --coverage --db-version ${{ matrix.exasol-version }}

- name: Upload Artifacts
uses: actions/upload-artifact@v4.6.2
uses: actions/upload-artifact@v5
with:
name: coverage-python${{ matrix.python-version }}-${{matrix.connector}}-exasol${{ matrix.exasol-version }}slow
path: .coverage
Expand Down
1 change: 1 addition & 0 deletions doc/changes/unreleased.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,3 +24,4 @@ This allows us to use the latest dependencies, which do not have open vulnerabil
- Reformatted files to meet project specifications
- #588: Updated to exasol-toolbox 1.6.0 and relocked dependencies to resolve CVE-2025-50182, CVE-2025-50181, & CVE-2024-47081
- #605: Removed non-ASCII unicode from templates & relocked dependencies to resolve CVE-2025-8869 (pip -> transitive dependency)
- #640: Re-locked dependencies to resolve CVE-2025-8869 for transitive dependency pip
25 changes: 12 additions & 13 deletions noxconfig.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,9 +1,9 @@
from __future__ import annotations

from collections.abc import Iterable
from dataclasses import dataclass
from pathlib import Path

from exasol.toolbox.config import BaseConfig
from exasol.toolbox.nox.plugin import hookimpl


Expand All @@ -12,7 +12,7 @@ class StartDB:
@hookimpl
def pre_integration_tests_hook(self, session, config, context):
port = context.get("port", 8563)
db_version = context.get("db_version", "7.1.17")
db_version = context.get("db_version", "2025.1.0")
Copy link
Copy Markdown
Collaborator Author

@ArBridgeman ArBridgeman Oct 30, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As the tests currently succeed with 2025.1.0, we update to this latest version for the default database version when executing the integration tests.

In the future, we can hopefully get this from the PROJECT_CONFIG via the inherited BaseConfig.

session.run(
"itde",
"spawn-test-environment",
Expand All @@ -38,8 +38,7 @@ def post_integration_tests_hook(self, session, config, context):
session.run("docker", "kill", "db_container_test", external=True)


@dataclass(frozen=True)
class Config:
class Config(BaseConfig):
root: Path = Path(__file__).parent
doc: Path = Path(__file__).parent / "doc"
source: Path = Path("sqlalchemy_exasol")
Expand All @@ -49,14 +48,14 @@ class Config:
".eggs",
"venv",
)
environment_name = "test"
db_port = 8563
bucketfs_port = 2580
connectors = ["pyodbc", "turbodbc", "websocket"]
python_versions = ["3.10", "3.11", "3.12", "3.13"]
exasol_versions = ["7.1.30", "8.34.0", "2025.1.0"]
environment_name: str = "test"
db_port: int = 8563
bucketfs_port: int = 2580
connectors: list[str] = ["pyodbc", "turbodbc", "websocket"]
plugins: list = [StartDB, StopDB]

plugins = [StartDB, StopDB]


PROJECT_CONFIG = Config()
PROJECT_CONFIG = Config(
# PTB 1.12.0 still supports Python 3.9, so we override the python_versions
python_versions=("3.10", "3.11", "3.12", "3.13"),
)
Loading
Loading