You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@superset.apache.org by "nigzak (via GitHub)" <gi...@apache.org> on 2024/02/26 14:24:12 UTC
[PR] chore: update cryptography to >= 41.0.5 [superset]
nigzak opened a new pull request, #27249:
URL: https://github.com/apache/superset/pull/27249
<!---
Please write the PR title following the conventions at https://www.conventionalcommits.org/en/v1.0.0/
Example:
fix(dashboard): load charts correctly
-->
### SUMMARY
cryptography has some high CVE findings which are fixed with newer version.
To fix this the min-version in setup.py should be updated to latest version (41.0.5)
CVE-2024-26130 (CVSS 7.5)
CVE-2023-50782 (CVSS 7.5)
CVE-2024-0727 (CVSS 5.5)
CVE-2023-49083 (CVSS 5.9)
(and some low)
### BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF
### TESTING INSTRUCTIONS
Open final build software and check that cryptography 41.0.5 (or newer) is inside
### ADDITIONAL INFORMATION
<!--- Check any relevant boxes with "x" -->
<!--- HINT: Include "Fixes #nnn" if you are fixing an existing issue -->
- [ ] Has associated issue:
- [ ] Required feature flags:
- [ ] Changes UI
- [ ] Includes DB Migration (follow approval process in [SIP-59](https://github.com/apache/superset/issues/13351))
- [ ] Migration is atomic, supports rollback & is backwards-compatible
- [ ] Confirm DB migration upgrade and downgrade tested
- [ ] Runtime estimates and downtime expectations provided
- [ ] Introduces new feature or API
- [ ] Removes existing feature or API
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] chore: update cryptography to >= 42.0.5 [superset]
Posted by "dpgaspar (via GitHub)" <gi...@apache.org>.
dpgaspar commented on code in PR #27249:
URL: https://github.com/apache/superset/pull/27249#discussion_r1502891968
##########
setup.py:
##########
@@ -81,7 +81,7 @@ def get_git_sha() -> str:
"croniter>=0.3.28",
"cron-descriptor",
# snowflake-connector-python as of 3.7.0 doesn't support >=42.* therefore lowering the min to 41.0.2
- "cryptography>=41.0.2, <43.0.0",
+ "cryptography>=42.0.5, <43.0.0",
Review Comment:
We need to keep this at `41.0.2` because there are extra dependencies that colide with it
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] chore: update cryptography to >= 42.0.5 [superset]
Posted by "nigzak (via GitHub)" <gi...@apache.org>.
nigzak commented on PR #27249:
URL: https://github.com/apache/superset/pull/27249#issuecomment-1973545140
cryptography 42.0.4 also has no findings (CVE scan) and it is already in master
=> closing this pull request now because it is outdated
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] chore: update cryptography to >= 42.0.5 [superset]
Posted by "dpgaspar (via GitHub)" <gi...@apache.org>.
dpgaspar commented on PR #27249:
URL: https://github.com/apache/superset/pull/27249#issuecomment-1969185982
This is being done here: https://github.com/apache/superset/pull/27281 snowflake just updated and released.
After 27281 is merged I think we can close this one
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] chore: update cryptography to >= 42.0.5 [superset]
Posted by "nigzak (via GitHub)" <gi...@apache.org>.
nigzak commented on code in PR #27249:
URL: https://github.com/apache/superset/pull/27249#discussion_r1503047216
##########
setup.py:
##########
@@ -81,7 +81,7 @@ def get_git_sha() -> str:
"croniter>=0.3.28",
"cron-descriptor",
# snowflake-connector-python as of 3.7.0 doesn't support >=42.* therefore lowering the min to 41.0.2
- "cryptography>=41.0.2, <43.0.0",
+ "cryptography>=42.0.5, <43.0.0",
Review Comment:
you mean to roll back the changes and only add the 42.0.5 version in base.in instead for now - right?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] chore: update cryptography to >= 42.0.5 [superset]
Posted by "dpgaspar (via GitHub)" <gi...@apache.org>.
dpgaspar commented on code in PR #27249:
URL: https://github.com/apache/superset/pull/27249#discussion_r1502891968
##########
setup.py:
##########
@@ -81,7 +81,7 @@ def get_git_sha() -> str:
"croniter>=0.3.28",
"cron-descriptor",
# snowflake-connector-python as of 3.7.0 doesn't support >=42.* therefore lowering the min to 41.0.2
- "cryptography>=41.0.2, <43.0.0",
+ "cryptography>=42.0.5, <43.0.0",
Review Comment:
We need to keep this at `41.0.2` because there are extra dependencies that colide with it. use `base.in` instead
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] chore: update cryptography to >= 42.0.5 [superset]
Posted by "nigzak (via GitHub)" <gi...@apache.org>.
nigzak closed pull request #27249: chore: update cryptography to >= 42.0.5
URL: https://github.com/apache/superset/pull/27249
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] chore: update cryptography to >= 41.0.5 [superset]
Posted by "nigzak (via GitHub)" <gi...@apache.org>.
nigzak closed pull request #27249: chore: update cryptography to >= 41.0.5
URL: https://github.com/apache/superset/pull/27249
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] chore: update cryptography to >= 42.0.5 [superset]
Posted by "codecov[bot] (via GitHub)" <gi...@apache.org>.
codecov[bot] commented on PR #27249:
URL: https://github.com/apache/superset/pull/27249#issuecomment-1964543636
## [Codecov](https://app.codecov.io/gh/apache/superset/pull/27249?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) Report
All modified and coverable lines are covered by tests :white_check_mark:
> Project coverage is 69.40%. Comparing base [(`1d571ec`)](https://app.codecov.io/gh/apache/superset/commit/1d571ec9e6e769d9715ee1e5c398aca079ba6207?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) to head [(`44c9eb9`)](https://app.codecov.io/gh/apache/superset/pull/27249?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
> Report is 1 commits behind head on master.
<details><summary>Additional details and impacted files</summary>
```diff
@@ Coverage Diff @@
## master #27249 +/- ##
==========================================
- Coverage 69.69% 69.40% -0.29%
==========================================
Files 1908 1908
Lines 74530 74530
Branches 8309 8309
==========================================
- Hits 51942 51729 -213
- Misses 20535 20748 +213
Partials 2053 2053
```
| [Flag](https://app.codecov.io/gh/apache/superset/pull/27249/flags?src=pr&el=flags&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | Coverage Δ | |
|---|---|---|
| [hive](https://app.codecov.io/gh/apache/superset/pull/27249/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `?` | |
| [mysql](https://app.codecov.io/gh/apache/superset/pull/27249/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `?` | |
| [postgres](https://app.codecov.io/gh/apache/superset/pull/27249/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `?` | |
| [presto](https://app.codecov.io/gh/apache/superset/pull/27249/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `?` | |
| [python](https://app.codecov.io/gh/apache/superset/pull/27249/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `82.53% <ø> (-0.60%)` | :arrow_down: |
| [sqlite](https://app.codecov.io/gh/apache/superset/pull/27249/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `77.61% <ø> (ø)` | |
| [unit](https://app.codecov.io/gh/apache/superset/pull/27249/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `56.51% <ø> (ø)` | |
Flags with carried forward coverage won't be shown. [Click here](https://docs.codecov.io/docs/carryforward-flags?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache#carryforward-flags-in-the-pull-request-comment) to find out more.
</details>
[:umbrella: View full report in Codecov by Sentry](https://app.codecov.io/gh/apache/superset/pull/27249?src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
:loudspeaker: Have feedback on the report? [Share it here](https://about.codecov.io/codecov-pr-comment-feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] chore: update cryptography to >= 42.0.5 [superset]
Posted by "sadpandajoe (via GitHub)" <gi...@apache.org>.
sadpandajoe commented on PR #27249:
URL: https://github.com/apache/superset/pull/27249#issuecomment-1971832225
> This is being done here: #27281 snowflake just updated and released. After 27281 is merged I think we can close this one
I just merged #27281 so you can rebase and bump if you need to.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org