Thoughts on SQLAlchemy security vulnerability issue reported by dependabot

[anuveyatsu]

ckanext-dcat-usmetadata extension does not have any additional python dependencies to work. We only have 2 dependencies for packaging and publishing the extension to PyPI which are listed in here:

https://github.com/GSA/ckanext-dcat_usmetadata/blob/master/dev-requirements.txt

The requirements.txt and requirements-freeze.txt files list dependencies for CKAN app (inventory app). This is how the repository was set initially for running integration tests in the CI. For details, please see the Dockerfile:

https://github.com/GSA/ckanext-dcat_usmetadata/blob/master/Dockerfile (you can notice that requirments.txt is only used to create inventory app like environment and then install ckanext-dcat-usmetadata extension for tests).

To summarize, the alert is not related to the extension but to Inventory App and CKAN version that is used there. I can see 2 options:

1. To remove the alert, we can change our setup, eg, clone inventory app repo in the CI instead of copying all the requirements from it. This way we will have no SQLAlchemy dependency mention (+ any other irrelevant dependencies). I believe this the right way to go.
2. Ignore the alert and notify the team that alert is about inventory app and we should fix it there.

About the alert

The depandabot alert suggests:

In inventory app, the same version of the SQLAlchemy is used (0.9.6):

• https://github.com/GSA/inventory-app/blob/improved-metadata-form/requirements-freeze.txt#L65
• https://github.com/GSA/inventory-app/blob/improved-metadata-form/requirements.txt#L30

[anuveyatsu]

@adborden could you take a look at this issue and let me know your thoughts please?

[adborden]

@anuveyatsu thanks, it's okay to make exceptions, we just need to document them. For inventory-app, we've already made an exception in snyk. So we can re-use that exception and document it in this repository.

[adborden]

I've dismissed the alert in GH as the same exception applies.

No remediation path available for CKAN2.3 (not compatible with Alchemy > 1.x). Need to resolve moving to CKAN2.8 for inventory (GSA/data.gov#993). Reviewed group_by and order_by usage manually, all user input sanitized.