diff --git a/.github/workflows/build-and-publish.yml b/.github/workflows/build-and-publish.yml index 9ba56f8..867d79c 100644 --- a/.github/workflows/build-and-publish.yml +++ b/.github/workflows/build-and-publish.yml @@ -19,7 +19,7 @@ jobs: - name: Set up Python & Poetry Environment id: set-up-python-and-poetry-environment - uses: exasol/python-toolbox/.github/actions/python-environment@v6 + uses: exasol/python-toolbox/.github/actions/python-environment@v7 with: python-version: "3.10" poetry-version: "2.3.0" diff --git a/.github/workflows/check-release-tag.yml b/.github/workflows/check-release-tag.yml index 5423c11..f099fa9 100644 --- a/.github/workflows/check-release-tag.yml +++ b/.github/workflows/check-release-tag.yml @@ -17,7 +17,7 @@ jobs: - name: Set up Python & Poetry Environment id: set-up-python-and-poetry-environment - uses: exasol/python-toolbox/.github/actions/python-environment@v6 + uses: exasol/python-toolbox/.github/actions/python-environment@v7 with: python-version: "3.10" poetry-version: "2.3.0" diff --git a/.github/workflows/checks.yml b/.github/workflows/checks.yml index c0cc520..33f0b8a 100644 --- a/.github/workflows/checks.yml +++ b/.github/workflows/checks.yml @@ -4,27 +4,6 @@ on: workflow_call: jobs: - check-version: - name: Check Version - runs-on: "ubuntu-24.04" - permissions: - contents: read - steps: - - name: Check out Repository - id: check-out-repository - uses: actions/checkout@v6 - - - name: Set up Python & Poetry Environment - id: set-up-python-and-poetry-environment - uses: exasol/python-toolbox/.github/actions/python-environment@v6 - with: - python-version: "3.10" - poetry-version: "2.3.0" - - - name: Check Version - id: check-version - run: poetry run -- nox -s version:check - build-documentation-and-check-links: name: Docs runs-on: "ubuntu-24.04" @@ -37,7 +16,7 @@ jobs: - name: Set up Python & Poetry Environment id: set-up-python-and-poetry-environment - uses: exasol/python-toolbox/.github/actions/python-environment@v6 + uses: exasol/python-toolbox/.github/actions/python-environment@v7 with: python-version: "3.10" poetry-version: "2.3.0" @@ -63,7 +42,7 @@ jobs: - name: Set up Python & Poetry Environment id: set-up-python-and-poetry-environment - uses: exasol/python-toolbox/.github/actions/python-environment@v6 + uses: exasol/python-toolbox/.github/actions/python-environment@v7 with: python-version: "3.10" poetry-version: "2.3.0" @@ -88,7 +67,7 @@ jobs: - name: Set up Python & Poetry Environment id: set-up-python-and-poetry-environment - uses: exasol/python-toolbox/.github/actions/python-environment@v6 + uses: exasol/python-toolbox/.github/actions/python-environment@v7 with: python-version: ${{ matrix.python-versions }} poetry-version: "2.3.0" @@ -103,7 +82,6 @@ jobs: with: name: lint-python${{ matrix.python-versions }} path: | - .lint.txt .lint.json include-hidden-files: true @@ -124,7 +102,7 @@ jobs: - name: Set up Python & Poetry Environment id: set-up-python-and-poetry-environment - uses: exasol/python-toolbox/.github/actions/python-environment@v6 + uses: exasol/python-toolbox/.github/actions/python-environment@v7 with: python-version: ${{ matrix.python-versions }} poetry-version: "2.3.0" @@ -150,7 +128,7 @@ jobs: - name: Set up Python & Poetry Environment id: set-up-python-and-poetry-environment - uses: exasol/python-toolbox/.github/actions/python-environment@v6 + uses: exasol/python-toolbox/.github/actions/python-environment@v7 with: python-version: ${{ matrix.python-versions }} poetry-version: "2.3.0" @@ -179,7 +157,7 @@ jobs: - name: Set up Python & Poetry Environment id: set-up-python-and-poetry-environment - uses: exasol/python-toolbox/.github/actions/python-environment@v6 + uses: exasol/python-toolbox/.github/actions/python-environment@v7 with: python-version: "3.10" poetry-version: "2.3.0" @@ -201,7 +179,7 @@ jobs: - name: Set up Python & Poetry Environment id: set-up-python-and-poetry-environment - uses: exasol/python-toolbox/.github/actions/python-environment@v6 + uses: exasol/python-toolbox/.github/actions/python-environment@v7 with: python-version: "3.10" poetry-version: "2.3.0" @@ -227,7 +205,7 @@ jobs: - name: Set up Python & Poetry Environment id: set-up-python-and-poetry-environment - uses: exasol/python-toolbox/.github/actions/python-environment@v6 + uses: exasol/python-toolbox/.github/actions/python-environment@v7 with: python-version: ${{ matrix.python-versions }} poetry-version: "2.3.0" diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index a9b86cf..104045a 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -11,11 +11,18 @@ jobs: merge-gate: name: Merge Gate uses: ./.github/workflows/merge-gate.yml + with: + root-event: ${{ github.event_name }} secrets: inherit permissions: contents: read report: + # Job merge-gate requires manual approval for running the slow checks. If + # current workflow ci.yml is triggered by schedule, there is no manual + # interaction, manual approval will never be given, slow checks will not + # be executed, merge-gate will never terminate, and the report will never + # be called. name: Report needs: - merge-gate diff --git a/.github/workflows/gh-pages.yml b/.github/workflows/gh-pages.yml index 5616ebd..73c74dc 100644 --- a/.github/workflows/gh-pages.yml +++ b/.github/workflows/gh-pages.yml @@ -19,7 +19,7 @@ jobs: - name: Set up Python & Poetry Environment id: set-up-python-and-poetry-environment - uses: exasol/python-toolbox/.github/actions/python-environment@v6 + uses: exasol/python-toolbox/.github/actions/python-environment@v7 with: python-version: "3.10" poetry-version: "2.3.0" @@ -32,7 +32,7 @@ jobs: - name: Upload Artifact id: upload-artifact - uses: actions/upload-pages-artifact@v4 + uses: actions/upload-pages-artifact@v5.0.0 with: path: html-documentation @@ -50,4 +50,4 @@ jobs: steps: - name: Deploy to GitHub Pages id: deploy-to-github-pages - uses: actions/deploy-pages@v4 + uses: actions/deploy-pages@v5 diff --git a/.github/workflows/matrix-python.yml b/.github/workflows/matrix-python.yml index 328799b..e68fd4d 100644 --- a/.github/workflows/matrix-python.yml +++ b/.github/workflows/matrix-python.yml @@ -19,7 +19,7 @@ jobs: - name: Set up Python & Poetry Environment id: set-up-python-and-poetry-environment - uses: exasol/python-toolbox/.github/actions/python-environment@v6 + uses: exasol/python-toolbox/.github/actions/python-environment@v7 with: python-version: "3.10" poetry-version: "2.3.0" diff --git a/.github/workflows/merge-gate.yml b/.github/workflows/merge-gate.yml index d6c0d0e..46c0129 100644 --- a/.github/workflows/merge-gate.yml +++ b/.github/workflows/merge-gate.yml @@ -2,6 +2,12 @@ name: Merge-Gate on: workflow_call: + inputs: + root-event: + description: GitHub event triggering the root workflow ci.yml + required: false + type: string + default: unknown jobs: run-fast-checks: @@ -10,8 +16,18 @@ jobs: permissions: contents: read + fast-report: + name: Fast Report + needs: + - run-fast-checks + uses: ./.github/workflows/report.yml + secrets: inherit + permissions: + contents: read + approve-run-slow-tests: name: Approve Running Slow Tests? + if: ${{ inputs.root-event != 'schedule' }} runs-on: "ubuntu-24.04" permissions: contents: read diff --git a/.github/workflows/report.yml b/.github/workflows/report.yml index 922894e..7612aeb 100644 --- a/.github/workflows/report.yml +++ b/.github/workflows/report.yml @@ -20,7 +20,7 @@ jobs: - name: Set up Python & Poetry Environment id: set-up-python-and-poetry-environment - uses: exasol/python-toolbox/.github/actions/python-environment@v6 + uses: exasol/python-toolbox/.github/actions/python-environment@v7 with: python-version: "3.10" poetry-version: "2.3.0" @@ -45,24 +45,8 @@ jobs: SONAR_TOKEN: "${{ secrets.SONAR_TOKEN }}" run: poetry run -- nox -s sonar:check - - name: Generate Report - id: generate-report - run: poetry run -- nox -s project:report -- --format json | tee metrics.json - - - name: Upload Artifacts - id: upload-artifacts - uses: actions/upload-artifact@v7 - with: - name: metrics.json - path: metrics.json - - name: Generate GitHub Summary id: generate-github-summary run: |- echo -e "# Summary\n" >> $GITHUB_STEP_SUMMARY - poetry run -- nox -s project:report -- --format markdown >> $GITHUB_STEP_SUMMARY poetry run -- nox -s dependency:licenses >> $GITHUB_STEP_SUMMARY - echo -e "\n\n# Coverage\n" >> $GITHUB_STEP_SUMMARY - poetry run -- coverage report --format markdown >> $GITHUB_STEP_SUMMARY || true - poetry run -- tbx lint pretty-print >> $GITHUB_STEP_SUMMARY - poetry run -- tbx security pretty-print .security.json >> $GITHUB_STEP_SUMMARY diff --git a/.github/workflows/slow-checks.yml b/.github/workflows/slow-checks.yml index 90d5a64..aa70bab 100644 --- a/.github/workflows/slow-checks.yml +++ b/.github/workflows/slow-checks.yml @@ -31,9 +31,9 @@ jobs: - name: Set up Python & Poetry Environment id: set-up-python-and-poetry-environment - uses: exasol/python-toolbox/.github/actions/python-environment@v6 + uses: exasol/python-toolbox/.github/actions/python-environment@v7 with: - python-version: ${{ matrix.python-version }} + python-version: ${{ matrix.python-version }} poetry-version: "2.3.0" - name: Run Integration Tests diff --git a/doc/changes/unreleased.md b/doc/changes/unreleased.md index 7e28eb0..c1312fc 100644 --- a/doc/changes/unreleased.md +++ b/doc/changes/unreleased.md @@ -2,16 +2,11 @@ ## Summary -This release fixes vulnerabilities by updating dependencies: - -| Dependency | Affected | Vulnerability | Fixed in | Updated to | -|--------------|----------|----------------|----------|------------| -| black | 25.12.0 | CVE-2026-32274 | 26.3.1 | 26.3.1 | -| cryptography | 46.0.4 | CVE-2026-26007 | 46.0.5 | 46.0.6 | -| cryptography | 46.0.4 | CVE-2026-34073 | 46.0.6 | 46.0.6 | -| pygments | 2.19.2 | CVE-2026-4539 | 2.20.0 | 2.20.0 | -| requests | 2.32.5 | CVE-2026-25645 | 2.33.0 | 2.33.1 | - ## Security Issues * #76: Fixed vulnerabilities by updating dependencies +* #79: Fixed vulnerabilities by updating dependencies, increased `pytest` upper limit, and updated to PTB 7.0.0 + +## Refactoring + +* #78: Removed unneeded requests pin as pysonar removed their pinning \ No newline at end of file diff --git a/poetry.lock b/poetry.lock index 8572e2c..c2391ec 100644 --- a/poetry.lock +++ b/poetry.lock @@ -1,4 +1,4 @@ -# This file is automatically @generated by Poetry 2.3.0 and should not be changed by hand. +# This file is automatically @generated by Poetry 2.3.3 and should not be changed by hand. [[package]] name = "accessible-pygments" @@ -976,14 +976,14 @@ dates = ["pytz (>=2019.1)"] [[package]] name = "exasol-toolbox" -version = "6.1.1" +version = "7.0.0" description = "Your one-stop solution for managing all standard tasks and core workflows of your Python project." optional = false python-versions = "<4.0,>=3.10" groups = ["dev"] files = [ - {file = "exasol_toolbox-6.1.1-py3-none-any.whl", hash = "sha256:bedab1f03f2a7c4d92bf99b68080c1559cae1116f9f312faeb233f508d8c3cf1"}, - {file = "exasol_toolbox-6.1.1.tar.gz", hash = "sha256:973e1436206f5bb442da55b30e37c717c0cc50eacc754fdde638cbcd6bd5c43e"}, + {file = "exasol_toolbox-7.0.0-py3-none-any.whl", hash = "sha256:e71dc0822a157e0b1818a6f268f836bf0ee18f26ea6662893b2231813bb5afe4"}, + {file = "exasol_toolbox-7.0.0.tar.gz", hash = "sha256:0538366da5df1e800c6d43d2106273db97492f3964fdb48afdd9f1afee682365"}, ] [package.dependencies] @@ -2168,14 +2168,14 @@ tests = ["pytest (>=9)", "typing-extensions (>=4.15)"] [[package]] name = "pip" -version = "26.0.1" +version = "26.1" description = "The PyPA recommended tool for installing Python packages." optional = false -python-versions = ">=3.9" +python-versions = ">=3.10" groups = ["dev"] files = [ - {file = "pip-26.0.1-py3-none-any.whl", hash = "sha256:bdb1b08f4274833d62c1aa29e20907365a2ceb950410df15fc9521bad440122b"}, - {file = "pip-26.0.1.tar.gz", hash = "sha256:c4037d8a277c89b320abe636d59f91e6d0922d08a05b60e85e53b296613346d8"}, + {file = "pip-26.1-py3-none-any.whl", hash = "sha256:4e8486d821d814b77319acb7b9e8bf5a4ee7590a643e7cb21029f209be8573c1"}, + {file = "pip-26.1.tar.gz", hash = "sha256:81e13ebcca3ffa8cc85e4deff5c27e1ee26dea0aa7fc2f294a073ac208806ff3"}, ] [[package]] @@ -2330,22 +2330,22 @@ tests = ["pytest", "pytest-cov", "pytest-lazy-fixtures"] [[package]] name = "prysk" -version = "0.20.0" +version = "0.15.2" description = "Functional tests for command line applications" optional = false -python-versions = "<4.0.0,>=3.8" +python-versions = ">=3.7,<4.0.0" groups = ["dev"] files = [ - {file = "prysk-0.20.0-py3-none-any.whl", hash = "sha256:3758f59febe1ff27710c8ba69a8edad42286050d041ed8df519fc4bbeea41133"}, - {file = "prysk-0.20.0.tar.gz", hash = "sha256:3499d24c9c8d534754d3915218cb2ab59cf59a8d6f37acfb68dc582650e67e33"}, + {file = "prysk-0.15.2-py3-none-any.whl", hash = "sha256:9c571b31166bd0db1b2ea1b6d5f8fb6e6335d6172c9921ee3f9e680f6649a81d"}, + {file = "prysk-0.15.2.tar.gz", hash = "sha256:953b608561daed91aced9856fcd9e008e963c07e4bf1684d79be0b218d29b8bd"}, ] [package.dependencies] -pytest-prysk = {version = ">=0.2.0,<0.3.0", optional = true, markers = "extra == \"pytest-plugin\""} +pytest = {version = ">=7.0.1", optional = true, markers = "extra == \"pytest-plugin\""} rich = ">=13.3.1,<14.0.0" [package.extras] -pytest-plugin = ["pytest-prysk (>=0.2.0,<0.3.0)"] +pytest-plugin = ["pytest (>=7.0.1)"] [[package]] name = "py-serializable" @@ -2531,18 +2531,6 @@ files = [ [package.dependencies] typing-extensions = ">=4.14.1" -[[package]] -name = "pyfakefs" -version = "5.9.3" -description = "Implements a fake file system that mocks the Python file system modules." -optional = false -python-versions = ">=3.7" -groups = ["dev"] -files = [ - {file = "pyfakefs-5.9.3-py3-none-any.whl", hash = "sha256:14a0514e94ff156543208c0b4832facc68bdf19de993799b67d58dd5ca05ef30"}, - {file = "pyfakefs-5.9.3.tar.gz", hash = "sha256:b458b11abc8862d4d8500816170a9b25e10d07437332b9dffd651069f3d4c40c"}, -] - [[package]] name = "pygments" version = "2.20.0" @@ -2620,61 +2608,44 @@ diagrams = ["jinja2", "railroad-diagrams"] [[package]] name = "pysonar" -version = "1.0.2.1722" +version = "1.5.0.4793" description = "Sonar Scanner for the Python Ecosystem" optional = false python-versions = ">=3.9" groups = ["dev"] files = [ - {file = "pysonar-1.0.2.1722-py3-none-any.whl", hash = "sha256:abacede0e5f8ca1468ac644889e2e87e8adeae07718906fe4ad546f5feacbc5d"}, - {file = "pysonar-1.0.2.1722.tar.gz", hash = "sha256:fc024f5172b97faca6c280284a67be1bfaf8d76f4f04e37f93c86b70042bac15"}, + {file = "pysonar-1.5.0.4793-py3-none-any.whl", hash = "sha256:c55113e592562a5eddab6090c437cc60dde73e4cc6fea74b1292d438c62865d6"}, + {file = "pysonar-1.5.0.4793.tar.gz", hash = "sha256:52791bcb8b01efd7dc203a5428f2b1b48b19269bc2982582d6e4e5f127716ac3"}, ] [package.dependencies] -jproperties = ">=2.1.2,<3.0.0" -pyfakefs = ">=5.7.4,<6.0.0" -requests = ">=2.32.3,<3.0.0" -responses = ">=0.25.6,<0.26.0" -tomli = ">=2.2.1,<3.0.0" +jproperties = ">=2.1,<3" +requests = ">=2.32,<3" +tomli = ">=2.0,<3" [[package]] name = "pytest" -version = "7.4.4" +version = "9.0.3" description = "pytest: simple powerful testing with Python" optional = false -python-versions = ">=3.7" +python-versions = ">=3.10" groups = ["dev"] files = [ - {file = "pytest-7.4.4-py3-none-any.whl", hash = "sha256:b090cdf5ed60bf4c45261be03239c2c1c22df034fbffe691abe93cd80cea01d8"}, - {file = "pytest-7.4.4.tar.gz", hash = "sha256:2cf0005922c6ace4a3e2ec8b4080eb0d9753fdc93107415332f50ce9e7994280"}, + {file = "pytest-9.0.3-py3-none-any.whl", hash = "sha256:2c5efc453d45394fdd706ade797c0a81091eccd1d6e4bccfcd476e2b8e0ab5d9"}, + {file = "pytest-9.0.3.tar.gz", hash = "sha256:b86ada508af81d19edeb213c681b1d48246c1a91d304c6c81a427674c17eb91c"}, ] [package.dependencies] -colorama = {version = "*", markers = "sys_platform == \"win32\""} -exceptiongroup = {version = ">=1.0.0rc8", markers = "python_version < \"3.11\""} -iniconfig = "*" -packaging = "*" -pluggy = ">=0.12,<2.0" -tomli = {version = ">=1.0.0", markers = "python_version < \"3.11\""} +colorama = {version = ">=0.4", markers = "sys_platform == \"win32\""} +exceptiongroup = {version = ">=1", markers = "python_version < \"3.11\""} +iniconfig = ">=1.0.1" +packaging = ">=22" +pluggy = ">=1.5,<2" +pygments = ">=2.7.2" +tomli = {version = ">=1", markers = "python_version < \"3.11\""} [package.extras] -testing = ["argcomplete", "attrs (>=19.2.0)", "hypothesis (>=3.56)", "mock", "nose", "pygments (>=2.7.2)", "requests", "setuptools", "xmlschema"] - -[[package]] -name = "pytest-prysk" -version = "0.2.0" -description = "Pytest plugin for prysk" -optional = false -python-versions = ">=3.8,<4.0" -groups = ["dev"] -files = [ - {file = "pytest_prysk-0.2.0-py3-none-any.whl", hash = "sha256:3180a9d3a6634e6e70107b2eed2a6a7420630b14ba2036598ef690f9b71be79f"}, - {file = "pytest_prysk-0.2.0.tar.gz", hash = "sha256:488d1f77e35beec9cad13e11368dcc5d09555ec31a4d6a3f9d901e78bbeeb2d1"}, -] - -[package.dependencies] -prysk = ">=0.15.0" -pytest = ">=7.3.2,<8.0.0" +dev = ["argcomplete", "attrs (>=19.2)", "hypothesis (>=3.56)", "mock", "requests", "setuptools", "xmlschema"] [[package]] name = "python-discovery" @@ -2919,26 +2890,6 @@ files = [ [package.dependencies] requests = ">=2.0.1,<3.0.0" -[[package]] -name = "responses" -version = "0.25.8" -description = "A utility library for mocking out the `requests` Python library." -optional = false -python-versions = ">=3.8" -groups = ["dev"] -files = [ - {file = "responses-0.25.8-py3-none-any.whl", hash = "sha256:0c710af92def29c8352ceadff0c3fe340ace27cf5af1bbe46fb71275bcd2831c"}, - {file = "responses-0.25.8.tar.gz", hash = "sha256:9374d047a575c8f781b94454db5cab590b6029505f488d12899ddb10a4af1cf4"}, -] - -[package.dependencies] -pyyaml = "*" -requests = ">=2.30.0,<3.0" -urllib3 = ">=1.25.10,<3.0" - -[package.extras] -tests = ["coverage (>=6.0.0)", "flake8", "mypy", "pytest (>=7.0.0)", "pytest-asyncio", "pytest-cov", "pytest-httpserver", "tomli ; python_version < \"3.11\"", "tomli-w", "types-PyYAML", "types-requests"] - [[package]] name = "rfc3986" version = "2.0.0" @@ -3889,4 +3840,4 @@ type = ["pytest-mypy"] [metadata] lock-version = "2.1" python-versions = ">=3.10,<4.0" -content-hash = "b7aba286df4ff8786f129924951af14a13b840db7728e91b8fdbb0b5bcc0a828" +content-hash = "182d4b8413fd1c54a2852e18a81da816c76e72bd43692a4533a20df7a357ef88" diff --git a/pyproject.toml b/pyproject.toml index ca17423..b6cdb12 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -1,41 +1,53 @@ [project] name = "exasol-error-reporting" version = "1.1.0" -requires-python = ">=3.10,<4.0" description = "Exasol Python Error Reporting" authors = [ - {name="Umit Buyuksahin", email="umit.buyuksahin@exasol.com"}, - {name="Torsten Kilias", email="torsten.kilias@exasol.com"}, - {name="Nicola Coretti", email="nicola.coretti@exasol.com"}, + { name = "Umit Buyuksahin", email = "umit.buyuksahin@exasol.com" }, + { name = "Torsten Kilias", email = "torsten.kilias@exasol.com" }, + { name = "Nicola Coretti", email = "nicola.coretti@exasol.com" }, ] +requires-python = ">=3.10,<4.0" +readme = "README.md" license = "MIT" -readme = 'README.md' -keywords = ['exasol', 'python', 'error-reporting'] +keywords = [ + "exasol", + "python", + "error-reporting", +] +classifiers = [ + "Programming Language :: Python :: 3", + "Programming Language :: Python :: 3.10", + "Programming Language :: Python :: 3.11", + "Programming Language :: Python :: 3.12", + "Programming Language :: Python :: 3.13", + "Programming Language :: Python :: 3.14", +] [project.urls] repository = "https://github.com/exasol/error-reporting-python" homepage = "https://github.com/exasol/error-reporting-python" +[project.scripts] +ec = "exasol.error._cli:main" + +[dependency-groups] +dev = [ + "pytest>=7.1.2,<10", + "prysk[pytest-plugin]>=0.15.1", + "exasol-toolbox>=7, <8", +] + [tool.poetry] -requires-poetry = ">=2.1.0" +requires-poetry = ">=2.3.0" packages = [ {include = "exasol"} ] -[tool.poetry.group.dev.dependencies] -pytest = ">=7.1.2,<9" -prysk = {extras = ["pytest-plugin"], version = ">=0.15.1"} -exasol-toolbox = ">=6, <7" -requests = ">2.33" # see https://github.com/exasol/error-reporting-python/issues/78 - [build-system] requires = ["poetry-core>=2.0.0"] build-backend = "poetry.core.masonry.api" -[tool.poetry.scripts] -ec = 'exasol.error._cli:main' - - [tool.coverage.run] relative_files = true source = [ @@ -84,4 +96,4 @@ unfixable = [] [tool.sonar] projectKey = "com.exasol:error-reporting-python" host.url = "https://sonarcloud.io" -organization = "exasol" \ No newline at end of file +organization = "exasol"