Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

WIP Upgrade due to sec vul #181

Open
wants to merge 6 commits into
base: dev
Choose a base branch
from
Open

WIP Upgrade due to sec vul #181

wants to merge 6 commits into from

Conversation

lvarin
Copy link
Contributor

@lvarin lvarin commented Jan 7, 2025

IMPORTANT: Please create an issue before filing a pull request! Changes need to be discussed before proceeding. Please read the contribution guidelines.

Details

Please provide enough information so that others can review your pull request. Give a brief summary of the motivation. Refer to the corresponding issue/s with #XXXX for more information.

Testing

Write the appropriate unit and integration tests, if applicable. Make sure these and all other tests pass.

Documentation

Please document your changes and test cases in the appropriate places, if applicable.

Style

Make sure your changes adhere to the coding/documentation style used throughout the project.

Closing issues

If your changes fix any issue/s, put closes #XXXX in your comment to auto-close it/them.

Credit

Add your credentials to the list of contributors once your pull request was merged.

Summary by Sourcery

Build:

  • Upgrade gunicorn dependency to version 22 in requirements.txt to address a security vulnerability.

@lvarin lvarin requested a review from uniqueg January 7, 2025 07:12
Copy link

sourcery-ai bot commented Jan 7, 2025

Reviewer's Guide by Sourcery

This pull request upgrades the gunicorn package in the requirements.txt file to version 22 or higher to address a security vulnerability.

No diagrams generated as the changes look simple and do not need a visual representation.

File-Level Changes

Change Details Files
Upgrade of the gunicorn package to address a security vulnerability.
  • Updated the version constraint for gunicorn from '>=20.1.0,<21' to '>=22'.
requirements.txt

Tips and commands

Interacting with Sourcery

  • Trigger a new review: Comment @sourcery-ai review on the pull request.
  • Continue discussions: Reply directly to Sourcery's review comments.
  • Generate a GitHub issue from a review comment: Ask Sourcery to create an
    issue from a review comment by replying to it.
  • Generate a pull request title: Write @sourcery-ai anywhere in the pull
    request title to generate a title at any time.
  • Generate a pull request summary: Write @sourcery-ai summary anywhere in
    the pull request body to generate a PR summary at any time. You can also use
    this command to specify where the summary should be inserted.

Customizing Your Experience

Access your dashboard to:

  • Enable or disable review features such as the Sourcery-generated pull request
    summary, the reviewer's guide, and others.
  • Change the review language.
  • Add, remove or edit custom review instructions.
  • Adjust other review settings.

Getting Help

Copy link

@sourcery-ai sourcery-ai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We have skipped reviewing this pull request. We don't review packaging changes - Let us know if you'd like us to change this.

Copy link
Member

@uniqueg uniqueg left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, but will merge after someone fixed the CI - which seems to have accumulated issues unrelated to this PR.

@JaeAeich maybe?

@JaeAeich
Copy link
Contributor

JaeAeich commented Jan 7, 2025

LGTM, but will merge after someone fixed the CI - which seems to have accumulated issues unrelated to this PR.

@JaeAeich maybe?

The CI issue runs deep. I would say bypass it rn and fix the CI in another PR perhaps, just a suggestion.

@lvarin
Copy link
Contributor Author

lvarin commented Jan 8, 2025

I will give it a go to try to fix it. But indeed it looks like the errors will not be easy to fix. I will focus on the docker-compose error because this comes after github changed something on their end.

@lvarin
Copy link
Contributor Author

lvarin commented Jan 8, 2025

I tried, but I did not manage to make the CI pass, as expected. But I think that now the errors are real issues with the app.

Feel free to close this. What do you think @uniqueg and the rest?

@uniqueg
Copy link
Member

uniqueg commented Jan 9, 2025

@lvarin: The Docker Compose issue is probably due to Compose being bundled with Docker CE versions for years now, accessible via docker compose - without the dash. So I guess the GitHub Actions machines don't bother with providing the old, separate docker-compose anymore, which is fair enough. That being said, I doubt that using docker compose instead of docker-compose will fix the underlying issues.

We will figure it out soon, as we need to keep on working on proTES anyway.

@lvarin
Copy link
Contributor Author

lvarin commented Jan 9, 2025

Docker compose with or without - is not the issue indeed. The docker compose issue and other lint issues (line too long errors) are fixed on this PR.

But the CI issues need to be fixed independently of this security vulnerability update.

The code errors seems to be related with pymongo changes in new versions.

@lvarin lvarin changed the title Upgrade due to sec vul WIP Upgrade due to sec vul Jan 9, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants