Skip to content

Temporarily remove web caching due to diskcache CVE #1470

Merged
cdiener merged 4 commits intodevelfrom
fix/diskcache_cve
Mar 25, 2026
Merged

Temporarily remove web caching due to diskcache CVE #1470
cdiener merged 4 commits intodevelfrom
fix/diskcache_cve

Conversation

@cdiener
Copy link
Copy Markdown
Member

@cdiener cdiener commented Mar 23, 2026

  • fix failing safety checks
  • description of feature/fix
  • tests added/passed
  • add an entry to the next release

The diskcache package is currently flagged with a CVE. Unfortunately the project seems to be abandoned and no fix has been merged for 1+ months. This temporarily removes the dependency of diskcache by disabling the caching. I am happy to reactivate if the CVE gets fixed or an alternative pops up. I could not find a package that does the same.

@Midnighter
Copy link
Copy Markdown
Member

There is a caching layer directly for HTTPX that uses sqlite underneath. Perhaps that could be used and would remove some of the logic here.

https://hishel.com/

I've been wondering whether code for interacting with repositories should be moved into a separate package...

@cdiener
Copy link
Copy Markdown
Member Author

cdiener commented Mar 24, 2026

Might work but it does not provide a max cache size and it would have to be implemented at another place in the codebase (the actual download). Though I would prefer the cache to be a directory of SBML files, not some binary format hidden away in a DB.

@cdiener
Copy link
Copy Markdown
Member Author

cdiener commented Mar 24, 2026

I agree with everything else. Separate package for web loading and caching would be great. Also because the testing strategy probably should be different. Outages in Biomodels currently break our CI for instance.

@cdiener cdiener force-pushed the fix/diskcache_cve branch from 108ac03 to 59a993a Compare March 24, 2026 13:34
@cdiener cdiener merged commit 1432033 into devel Mar 25, 2026
13 checks passed
@cdiener cdiener deleted the fix/diskcache_cve branch March 25, 2026 06:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants