Skip to content

Commit 03b60bf

Browse files
erikboschBjoernAtBoschMP91
authored
Fix aiohttp vulnerability (#152)
* Fix aiohttp vulnerability * Test undefined version * Prepare for release * Apply suggestions from code review Co-authored-by: BjoernAtBosch <[email protected]> * update requirements * fix licenses * fix review findings * update test requirements * fix requirements * fix readme and comment * fix typo --------- Co-authored-by: BjoernAtBosch <[email protected]> Co-authored-by: Markus Petke <[email protected]>
1 parent 64e6ec9 commit 03b60bf

23 files changed

+283
-242
lines changed

‎.github/workflows/project-creation.yaml

+6-2
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,7 @@ jobs:
5050
with:
5151
repository: eclipse-velocitas/cli
5252
path: cli
53-
ref: v0.11.0
53+
ref: v0.13.1
5454

5555
- name: Checkout SDK repo
5656
uses: actions/checkout@v4
@@ -92,7 +92,11 @@ jobs:
9292
CREATE_ARGS="-e ${{ matrix.example }}"
9393
fi
9494
velocitas create -c vapp-core-python $CREATE_ARGS
95-
# Velocitas CLI fetches an older merged/released version of the example
95+
96+
# Velocitas CLI does not fetch the latest released version of the example.
97+
# This is caused by vehicle-app-template that downloads latest tagged version of pkg-velocitas-main,
98+
# which then uses the latest tagged SDK or the version mentioned in
99+
# components/cores/vapp-python/.project-creation/config.json if no tags are found.
96100
# But we want to check the one in this repository so lets copy it
97101
if [ "${{ matrix.example }}" != "no-example" ]; then
98102
cp -r ../sdk/examples/${{ matrix.example }}/* ../app/app

‎.pre-commit-config.yaml

+4-4
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@
1717
# See https://pre-commit.com/hooks.html for more hooks
1818
repos:
1919
- repo: https://github.com/pre-commit/pre-commit-hooks
20-
rev: v4.4.0
20+
rev: v5.0.0
2121
hooks:
2222
- id: trailing-whitespace
2323
exclude: >
@@ -45,15 +45,15 @@ repos:
4545
- id: check-merge-conflict
4646

4747
- repo: https://github.com/astral-sh/ruff-pre-commit
48-
rev: v0.1.13
48+
rev: v0.9.10
4949
hooks:
5050
- id: ruff
5151
args: [--fix, --exclude, "*_pb2.py,*_pb2.pyi,*_pb2_grpc.py,*.log"]
5252
- id: ruff-format
5353
args: [--exclude, "*_pb2.py,*_pb2.pyi,*_pb2_grpc.py,*.log"]
5454

5555
- repo: https://github.com/pre-commit/mirrors-mypy
56-
rev: v1.8.0
56+
rev: v1.15.0
5757
hooks:
5858
- id: mypy
5959
exclude: >
@@ -67,7 +67,7 @@ repos:
6767
pass_filenames: false
6868

6969
- repo: https://github.com/Lucas-C/pre-commit-hooks
70-
rev: v1.5.4
70+
rev: v1.5.5
7171
hooks:
7272
- id: insert-license
7373
files: '.*\.(py|pyi|yaml|yml|sh|in)$'

‎.project-creation/.skeleton/requirements-velocitas.txt

+1-1
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
velocitas-sdk==0.15.4
1+
velocitas-sdk==0.15.5

‎.project-creation/.skeleton/requirements.in

+1-1
Original file line numberDiff line numberDiff line change
@@ -15,4 +15,4 @@
1515
grpcio==1.64.1
1616
protobuf==5.27.2
1717
cloudevents==1.11.0
18-
aiohttp==3.10.5
18+
aiohttp==3.10.11

‎.project-creation/.skeleton/requirements.txt

+14-10
Original file line numberDiff line numberDiff line change
@@ -4,35 +4,39 @@
44
#
55
# pip-compile
66
#
7-
aiohappyeyeballs==2.4.0
7+
aiohappyeyeballs==2.5.0
88
# via aiohttp
9-
aiohttp==3.10.5
9+
aiohttp==3.10.11
1010
# via -r requirements.in
11-
aiosignal==1.3.1
11+
aiosignal==1.3.2
1212
# via aiohttp
13-
async-timeout==4.0.3
13+
async-timeout==5.0.1
1414
# via aiohttp
15-
attrs==24.2.0
15+
attrs==25.1.0
1616
# via aiohttp
1717
cloudevents==1.11.0
1818
# via -r requirements.in
1919
deprecation==2.1.0
2020
# via cloudevents
21-
frozenlist==1.4.1
21+
frozenlist==1.5.0
2222
# via
2323
# aiohttp
2424
# aiosignal
2525
grpcio==1.64.1
2626
# via -r requirements.in
27-
idna==3.8
27+
idna==3.10
2828
# via yarl
29-
multidict==6.0.5
29+
multidict==6.1.0
3030
# via
3131
# aiohttp
3232
# yarl
33-
packaging==24.1
33+
packaging==24.2
3434
# via deprecation
35+
propcache==0.3.0
36+
# via yarl
3537
protobuf==5.27.2
3638
# via -r requirements.in
37-
yarl==1.9.7
39+
typing-extensions==4.12.2
40+
# via multidict
41+
yarl==1.18.3
3842
# via aiohttp

‎.project-creation/.skeleton/tests/requirements.txt

+9-9
Original file line numberDiff line numberDiff line change
@@ -4,31 +4,31 @@
44
#
55
# pip-compile
66
#
7-
coverage[toml]==7.3.2
7+
coverage[toml]==7.6.12
88
# via pytest-cov
9-
exceptiongroup==1.1.3
9+
exceptiongroup==1.2.2
1010
# via pytest
1111
iniconfig==2.0.0
1212
# via pytest
13-
packaging==23.2
13+
packaging==24.2
1414
# via pytest
15-
pluggy==1.3.0
15+
pluggy==1.5.0
1616
# via pytest
17-
pytest==7.4.2
17+
pytest==8.3.5
1818
# via
1919
# -r requirements.in
2020
# pytest-asyncio
2121
# pytest-cov
2222
# pytest-ordering
23-
pytest-asyncio==0.21.1
23+
pytest-asyncio==0.25.3
2424
# via -r requirements.in
25-
pytest-cov==4.1.0
25+
pytest-cov==6.0.0
2626
# via -r requirements.in
2727
pytest-ordering==0.6
2828
# via -r requirements.in
29-
tomli==2.0.1
29+
tomli==2.2.1
3030
# via
3131
# coverage
3232
# pytest
33-
types-mock==5.1.0.2
33+
types-mock==5.2.0.20250306
3434
# via -r requirements.in

‎.project-creation/templates/requirements.in

+4-6
Original file line numberDiff line numberDiff line change
@@ -20,9 +20,7 @@
2020
##########################################
2121
# Development Tools Packages
2222
##########################################
23-
grpcio-tools==1.59.0
24-
grpc-stubs==1.53.0.5
25-
mypy-protobuf==3.5.0
26-
pre-commit==3.6.0
27-
mypy==1.8.0
28-
pip-tools==7.3.0
23+
mypy-protobuf
24+
pre-commit
25+
mypy
26+
pip-tools

‎NOTICE-3RD-PARTY-CONTENT.md

+38-39
Original file line numberDiff line numberDiff line change
@@ -3,35 +3,35 @@
33
## Python
44
| Dependency | Version | License |
55
|:-----------|:-------:|--------:|
6-
|aiohappyeyeballs|2.4.0|Other/Proprietary License<br/>Python Software Foundation License|
7-
|aiohttp|3.10.5|Apache 2.0|
8-
|aiosignal|1.3.1|Apache 2.0|
9-
|APScheduler|3.10.4|MIT|
10-
|async-timeout|4.0.3|Apache 2.0|
11-
|attrs|24.2.0|MIT|
12-
|build|1.2.1|MIT|
13-
|cachetools|5.5.0|MIT|
6+
|aiohappyeyeballs|2.5.0|Python Software Foundation License|
7+
|aiohttp|3.10.11|Apache 2.0|
8+
|aiosignal|1.3.2|Apache 2.0|
9+
|APScheduler|3.11.0|MIT|
10+
|async-timeout|5.0.1|Apache 2.0|
11+
|attrs|25.1.0|unknown|
12+
|build|1.2.2.post1|MIT|
13+
|cachetools|5.5.2|MIT|
1414
|cfgv|3.4.0|MIT|
1515
|chardet|5.2.0|LGPL|
16-
|click|8.1.7|New BSD|
16+
|click|8.1.8|BSD|
1717
|cloudevents|1.11.0|Apache 2.0|
1818
|colorama|0.4.6|BSD|
19-
|coverage|7.6.1|Apache 2.0|
20-
|Deprecated|1.2.14|MIT|
19+
|coverage|7.6.12|Apache 2.0|
20+
|Deprecated|1.2.18|MIT|
2121
|deprecation|2.1.0|Apache 2.0|
22-
|distlib|0.3.8|Python Software Foundation License|
22+
|distlib|0.3.9|Python Software Foundation License|
2323
|exceptiongroup|1.2.2|MIT|
24-
|filelock|3.15.4|The Unlicense (Unlicense)|
25-
|frozenlist|1.4.1|Apache 2.0|
24+
|filelock|3.17.0|The Unlicense (Unlicense)|
25+
|frozenlist|1.5.0|Apache 2.0|
2626
|grpc-stubs|1.53.0.5|MIT|
2727
|grpcio|1.64.1|Apache 2.0|
2828
|grpcio-tools|1.64.1|Apache 2.0|
29-
|identify|2.6.0|MIT|
30-
|idna|3.8|BSD|
29+
|identify|2.6.9|MIT|
30+
|idna|3.10|BSD|
3131
|importlib-metadata|7.1.0|Apache 2.0|
3232
|iniconfig|2.0.0|MIT|
33-
|multidict|6.0.5|Apache 2.0|
34-
|mypy|1.11.2|MIT|
33+
|multidict|6.1.0|Apache 2.0|
34+
|mypy|1.15.0|MIT|
3535
|mypy-extensions|1.0.0|MIT|
3636
|mypy-protobuf|3.6.0|Apache 2.0|
3737
|nodeenv|1.9.1|BSD|
@@ -41,35 +41,34 @@
4141
|opentelemetry-instrumentation-logging|0.46b0|Apache 2.0|
4242
|opentelemetry-sdk|1.25.0|Apache 2.0|
4343
|opentelemetry-semantic-conventions|0.46b0|Apache 2.0|
44-
|packaging|24.1|Apache 2.0<br/>BSD|
44+
|packaging|24.2|Apache 2.0<br/>BSD|
4545
|paho-mqtt|2.1.0|OSI Approved|
4646
|pip|23.0.1|MIT|
4747
|pip-tools|7.4.1|BSD|
48-
|platformdirs|4.2.2|MIT|
48+
|platformdirs|4.3.6|MIT|
4949
|pluggy|1.5.0|MIT|
50-
|pre-commit|3.8.0|MIT|
50+
|pre-commit|4.1.0|MIT|
51+
|propcache|0.3.0|Apache 2.0|
5152
|protobuf|5.27.2|Google License|
52-
|pyproject-api|1.7.1|MIT|
53-
|pyproject-hooks|1.1.0|MIT|
54-
|pytest|8.3.2|MIT|
55-
|pytest-asyncio|0.24.0|Apache 2.0|
56-
|pytest-cov|5.0.0|MIT|
57-
|pytz|2024.1|MIT|
53+
|pyproject-api|1.9.0|MIT|
54+
|pyproject-hooks|1.2.0|MIT|
55+
|pytest|8.3.5|MIT|
56+
|pytest-asyncio|0.25.3|Apache 2.0|
57+
|pytest-cov|6.0.0|MIT|
5858
|PyYAML|6.0.2|MIT|
5959
|setuptools|65.5.1|MIT|
60-
|six|1.16.0|MIT|
61-
|tomli|2.0.1|MIT|
62-
|tox|4.18.0|MIT|
63-
|types-Deprecated|1.2.9.20240311|Apache 2.0|
64-
|types-mock|5.1.0.20240425|Apache 2.0|
65-
|types-protobuf|5.27.0.20240626|Apache 2.0|
60+
|tomli|2.2.1|MIT|
61+
|tox|4.24.2|MIT|
62+
|types-deprecated|1.2.15.20250304|Apache 2.0|
63+
|types-mock|5.2.0.20250306|Apache 2.0|
64+
|types-protobuf|5.29.1.20250208|Apache 2.0|
6665
|typing-extensions|4.12.2|Python Software Foundation License|
67-
|tzlocal|5.2|MIT|
68-
|virtualenv|20.26.6|MIT|
69-
|wheel|0.44.0|MIT|
70-
|wrapt|1.16.0|BSD|
71-
|yarl|1.9.7|Apache 2.0|
72-
|zipp|3.20.1|MIT|
66+
|tzlocal|5.3.1|MIT|
67+
|virtualenv|20.29.3|MIT|
68+
|wheel|0.45.1|MIT|
69+
|wrapt|1.17.2|BSD|
70+
|yarl|1.18.3|Apache 2.0|
71+
|zipp|3.21.0|MIT|
7372
## Workflows
7473
| Dependency | Version | License |
7574
|:-----------|:-------:|--------:|

‎README.md

+65
Original file line numberDiff line numberDiff line change
@@ -63,3 +63,68 @@ By default the examples are started using the native middleware. Dapr middleware
6363
- [GitHub Issues](https://github.com/eclipse-velocitas/vehicle-app-python-sdk/issues)
6464
- [Mailing List](https://accounts.eclipse.org/mailing-list/velocitas-dev)
6565
- [Contribution](./CONTRIBUTING.md/)
66+
67+
### Creating a new release
68+
69+
1. Update examples
70+
71+
This repository contain some example requirement files that reference the `velocitas-sdk` package created when we release the repository.
72+
Update `velocitas-sdk` version number in the following files:
73+
74+
* `.project-creation/.skeleton/requirements-velocitas.txt`
75+
* `examples/seat-adjuster/requirements-velocitas.txt`
76+
77+
Use the version number intended to be used for the release.
78+
79+
2. Create a PR with the required changes
80+
81+
> Note: The [project creation workflow](https://github.com/eclipse-velocitas/vehicle-app-python-sdk/actions/workflows/project-creation.yaml) will fail, since the new tag is required by the workflow but not yet available. Since these checks are not mandatory to be able to merge the PR, you can still release your changes.
82+
83+
3. Once the PR is merged: Tag the commit and upload to GitHub
84+
85+
Create a release in the GitHub UI and use the new tag of the form `vX.Y.X`.
86+
That will trigger the [release](https://github.com/eclipse-velocitas/vehicle-app-python-sdk/actions/workflows/release.yaml) workflow.
87+
If the action is successfully executed a new version of `velocitas-sdk` is published in [PyPI](https://pypi.org/project/velocitas-sdk/).
88+
89+
4. Re-run project creation tests
90+
91+
Now, when the updated [PyPI](https://pypi.org/project/velocitas-sdk/) package exists, the [project creation workflow](https://github.com/eclipse-velocitas/vehicle-app-python-sdk/actions/workflows/project-creation.yaml) is expected to succeed if run manually for `main`.
92+
If not you need to troubleshoot why it doesn't.
93+
94+
### Updating Dependencies
95+
96+
This repository specifies exact Python versions in `setup.py` and other files.
97+
If a version needs to be updated, for example if a vulnerability is detected, the following approach needs to be followed
98+
99+
1. Update version in `setup.py` if needed
100+
2. Update generated requirement files.
101+
102+
```bash
103+
pip-compile -U --extra=dev
104+
```
105+
106+
3. Update version in `examples/seat-adjuster/requirements.in` if needed
107+
4. Update generated file for Seat Adjuster
108+
109+
```bash
110+
cd examples/seat-adjuster
111+
pip-compile -U
112+
```
113+
114+
5. Update version in `.project-creation/.skeleton/requirements.in` if needed
115+
6. Update generated file for Skeleton
116+
117+
```bash
118+
cd .project-creation/.skeleton/
119+
pip-compile -U
120+
```
121+
122+
7. Update `NOTICE-3RD-PARTY-CONTENT.md`
123+
124+
The easiest way to do it is to create a Pull Request.
125+
Then the [check license workflow](https://github.com/eclipse-velocitas/vehicle-app-python-sdk/actions/workflows/check-licenses.yml) will fail as versions used no longer match versions stated in the file.
126+
Copy output from the workflow to the `NOTICE-3RD-PARTY-CONTENT.md` file and update the Pull Request.
127+
128+
8. Update examples and create a new release
129+
130+
As we explicitly use our "own" PyPI package we need to udpate references and create a new release, see release section above.

‎examples/seat-adjuster/requirements-velocitas.txt

+1-1
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
velocitas-sdk==0.15.4
1+
velocitas-sdk==0.15.5

‎examples/seat-adjuster/requirements.in

+1-2
Original file line numberDiff line numberDiff line change
@@ -15,5 +15,4 @@
1515
grpcio==1.64.1
1616
protobuf==5.27.2
1717
cloudevents==1.11.0
18-
aiohttp==3.10.5
19-
packaging==24.1
18+
aiohttp==3.10.11

0 commit comments

Comments
 (0)