Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore: fix vulnerabilities and deprecation warnings #42

Merged
merged 1 commit into from
Sep 25, 2024

Conversation

saikumarrs
Copy link
Member

@saikumarrs saikumarrs commented Sep 25, 2024

Description of the change

  • Fixed vulnerabilities.
  • Fixed deprecation warnings on usage of datetime.datetime.utcnow().
  • Upgraded all the dependencies to the latest version.

=== Synk CLI output ===

Before:

snyk test --file=requirements.txt --package-manager=pip --python=python3

Testing /Volumes/Workspace/Repositories/rudder-sdk-python...

Tested 20 dependencies for known issues, found 2 issues, 4 vulnerable paths.


Issues to fix by upgrading dependencies:

  Upgrade certifi@2024.6.2 to certifi@2024.7.4 to fix
  ✗ Insufficient Verification of Data Authenticity [Medium Severity][https://security.snyk.io/vuln/SNYK-PYTHON-CERTIFI-7430173] in certifi@2024.6.2
    introduced by certifi@2024.6.2 and 1 other path(s)


License issues:

  ✗ MPL-2.0 license [Medium Severity][https://snyk.io/vuln/snyk:lic:pip:certifi:MPL-2.0] in certifi@2024.6.2
    introduced by certifi@2024.6.2 and 1 other path(s)



Organization:      rudder-qa
Package manager:   pip
Target file:       requirements.txt
Project name:      rudder-sdk-python
Open source:       no
Project path:      /Volumes/Workspace/Repositories/rudder-sdk-python
Licenses:          enabled

Tip: Try `snyk fix` to address these issues.`snyk fix` is a new CLI command in that aims to automatically apply the recommended updates for supported ecosystems.
See documentation on how to enable this beta feature: https://docs.snyk.io/snyk-cli/fix-vulnerabilities-from-the-cli/automatic-remediation-with-snyk-fix#enabling-snyk-fix

After:

snyk test --file=requirements.txt --package-manager=pip --python=python3

Testing /Volumes/Workspace/Repositories/rudder-sdk-python...

Tested 20 dependencies for known issues, found 1 issue, 2 vulnerable paths.


License issues:

  ✗ MPL-2.0 license [Medium Severity][https://snyk.io/vuln/snyk:lic:pip:certifi:MPL-2.0] in certifi@2024.8.30
    introduced by certifi@2024.8.30 and 1 other path(s)



Organization:      rudder-qa
Package manager:   pip
Target file:       requirements.txt
Project name:      rudder-sdk-python
Open source:       no
Project path:      /Volumes/Workspace/Repositories/rudder-sdk-python
Licenses:          enabled

Tip: Try `snyk fix` to address these issues.`snyk fix` is a new CLI command in that aims to automatically apply the recommended updates for supported ecosystems.
See documentation on how to enable this beta feature: https://docs.snyk.io/snyk-cli/fix-vulnerabilities-from-the-cli/automatic-remediation-with-snyk-fix#enabling-snyk-fix
  • We have to ignore the license issue temporarily.

Type of change

  • Bug fix (non-breaking change that fixes an issue)
  • New feature (non-breaking change that adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to not work as expected)

Related issues

Fix #1

Checklists

Development

  • Lint rules pass locally
  • The code changed/added as part of this pull request has been covered with tests
  • All tests related to the changed code pass in development

Code review

  • This pull request has a descriptive title and information useful to a reviewer. There may be a screenshot or screencast attached
  • "Ready for review" label attached to the PR and reviewers mentioned in a comment
  • Changes have been reviewed by at least one other engineer
  • Issue from task tracker has a link to this pull request

@saikumarrs saikumarrs self-assigned this Sep 25, 2024
Copy link

sonarcloud bot commented Sep 25, 2024

@saikumarrs saikumarrs merged commit 5aed86f into master Sep 25, 2024
12 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant