You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tooling.apache.org by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/03 19:49:52 UTC
[I] Pre-Release (Release Candidate) Dependency Used in Production (tooling-trusted-releases)
asf-tooling opened a new issue, #1133:
URL: https://github.com/apache/tooling-trusted-releases/issues/1133
**ASVS Level(s):** [L1]
**Description:**
### Summary
The application uses a release candidate version (ldap3==2.10.2rc3) in production without documented justification or special monitoring procedures. Release candidate versions have uncertain security patch processes and may not receive updates through standard channels, making the 30-day freshness policy less meaningful. If a vulnerability is discovered, the fix may be released in stable 2.9.x branch but not backported to 2.10.x RC branch, creating unclear upgrade paths.
### Details
**Current situation:**
- Production dependency: `ldap3==2.10.2rc3` (release candidate)
- Latest stable release: `ldap3==2.9.1`
- No documented justification for using RC version
- No special monitoring procedures for RC dependencies
**Security concerns:**
1. RC versions may not receive security patches through standard channels
2. Vulnerability fixes might be released only in stable branches
3. Unclear upgrade path if security issue found in RC version
4. 30-day freshness policy less meaningful for RC versions (no regular releases)
5. No established process for monitoring RC security status
**Affected file:** `pip-audit.requirements`, line 148
### Recommended Remediation
**Option A — Use stable version (preferred):**
1. Test application functionality with `ldap3==2.9.1`
2. If no regressions, prefer stable over RC
3. Update `pip-audit.requirements` to use stable version
**Option B — Document justification and establish monitoring:**
1. Create `DEPENDENCIES.md` with section for Pre-Release Dependencies:
```markdown
## Pre-Release Dependencies
### ldap3==2.10.2rc3
- **Reason:** [Document specific feature or bug fix required]
- **Stable alternative tested:** 2.9.1 [results]
- **Monitoring:** Weekly manual checks of releases
- **Security advisories:** Subscribed to ldap3 security notifications
- **Upgrade target:** Migrate to stable 2.10.x within 7 days of release
```
2. Establish explicit monitoring procedures:
- Weekly manual checks of ldap3 releases
- Subscribe to security advisories
- Document remediation timeline
**Option C — Automated RC version monitoring:**
Implement `scripts/check_prerelease_deps.py`:
```python
def check_prerelease_versions():
"""Detect pre-release versions and validate documentation exists."""
# Parse requirements for RC/alpha/beta versions
# Verify DEPENDENCIES.md documents each pre-release
# Fail if undocumented pre-release found
```
### Acceptance Criteria
- [ ] Either migrate to stable ldap3==2.9.1, or document justification for RC version
- [ ] If keeping RC: Create DEPENDENCIES.md with pre-release policy
- [ ] If keeping RC: Establish monitoring procedures
- [ ] If keeping RC: Subscribe to ldap3 security advisories
- [ ] Optional: Implement automated pre-release detection script
- [ ] Unit test verifying the fix
### References
- Source reports: L1:15.2.1.md
- Related findings: None
- ASVS sections: 15.2.1
### Priority
Low
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org
Re: [I] Pre-Release (Release Candidate) Dependency Used in Production (tooling-trusted-releases)
Posted by "sbp (via GitHub)" <gi...@apache.org>.
sbp commented on issue #1133:
URL: https://github.com/apache/tooling-trusted-releases/issues/1133#issuecomment-5181238838
We have decided not to fix this, and to take up maintenance of some LDAP component ourselves instead.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Pre-Release (Release Candidate) Dependency Used in Production (tooling-trusted-releases)
Posted by "dave2wave (via GitHub)" <gi...@apache.org>.
dave2wave commented on issue #1133:
URL: https://github.com/apache/tooling-trusted-releases/issues/1133#issuecomment-5180770343
See https://github.com/cannatag/ldap3/issues/1169 apparently there is an rc4, but also this is nearly a Bernie as you can see fro the maintainer's comments.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Pre-Release (Release Candidate) Dependency Used in Production (tooling-trusted-releases)
Posted by "asf-tooling (via GitHub)" <gi...@apache.org>.
asf-tooling commented on issue #1133:
URL: https://github.com/apache/tooling-trusted-releases/issues/1133#issuecomment-4407490544
<!-- gofannon-issue-triage-bot v2 -->
**Automated triage** — analyzed at `main@751c2146`
**Type:** `refactor` • **Classification:** `actionable` • **Confidence:** `low`
**Application domain(s):** `sbom_management`, `automated_checks`
### Summary
The issue reports that `ldap3==2.10.2rc3` (a release candidate) is used as a production dependency in `pip-audit.requirements` line 148, without documented justification. The concern is that RC versions may have unclear security patch processes. The architecture confirms LDAP is a core subsystem (`atr/ldap.py`, `atr/principal.py`, `atr/cache.py`), so `ldap3` is indeed a meaningful dependency. However, no source files were provided for review, so I cannot verify the current state of the dependency pinning or whether this has already been addressed.
### Where new code would go
- `pip-audit.requirements` — line 148 (per issue)
The issue claims ldap3==2.10.2rc3 is pinned here; this is where the version would be changed to stable or kept with documentation
- `DEPENDENCIES.md` — new file
If the RC is kept, the issue proposes documenting justification in a new DEPENDENCIES.md file
- `scripts/check_prerelease_deps.py` — new file
Optional automated pre-release detection script proposed in Option C
### Proposed approach
Since no source files were provided for inspection, I cannot verify the current state of `pip-audit.requirements` or determine why `ldap3==2.10.2rc3` was chosen over the stable `2.9.1`. The most pragmatic approach would be Option A (use stable version) if testing confirms no regressions, since the stable branch receives predictable security patches. If the RC is required for specific functionality (e.g., async support, bug fixes not in 2.9.x), then Option B (document justification) should be implemented.
A maintainer should first check whether `atr/ldap.py` uses any features exclusive to ldap3 2.10.x (such as asyncio support or specific connection pool improvements). If no 2.10-specific features are used, downgrade to stable. If they are, document the dependency in a `DEPENDENCIES.md` or inline comment explaining the rationale.
### Open questions
- What specific features from ldap3 2.10.x (if any) does atr/ldap.py rely on that are not available in stable 2.9.1?
- Is `pip-audit.requirements` a separate file from the main dependency specification (e.g., pyproject.toml), and does changing it affect the actual deployed dependency?
- Has ldap3 2.10.x been released as stable since this issue was filed? (The RC was published some time ago and upstream release status is unclear)
- Does the project already have a dependency policy documented elsewhere that covers pre-release usage?
### Related issues
This issue appears related to: #1132.
_Both concern dependency management policies and security requirements, with #1132 about undocumented policy enforcement and #1133 about pre-release dependencies in production_
---
*Draft from a triage agent. A human reviewer should validate before merging any change. The agent did not run tests or verify diffs apply.*
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org
Re: [I] Pre-Release (Release Candidate) Dependency Used in Production (tooling-trusted-releases)
Posted by "sbp (via GitHub)" <gi...@apache.org>.
sbp closed issue #1133: Pre-Release (Release Candidate) Dependency Used in Production
URL: https://github.com/apache/tooling-trusted-releases/issues/1133
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org