Security/228 update dependencies (#229)

ArBridgeman · web-flow · commit 2daf34e35a39 · 2025-07-03T12:23:35.000+02:00
* Update dependencies &amp; fix typos

* Update to python-toolbox 1.6.0 and its workflows

* Update broken and redirected links

* Add sonar values for projects being evaluated by CI checks

* Run project:fix on files
diff --git a/.github/workflows/build-and-publish.yml b/.github/workflows/build-and-publish.yml
@@ -18,7 +18,7 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Setup Python & Poetry Environment
-        uses: exasol/python-toolbox/.github/actions/python-environment@1.4.0
+        uses: exasol/python-toolbox/.github/actions/python-environment@1.6.0
 
       - name: Build Artifacts
         run: poetry build
diff --git a/.github/workflows/check-release-tag.yml b/.github/workflows/check-release-tag.yml
@@ -15,7 +15,7 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Setup Python & Poetry Environment
-        uses: exasol/python-toolbox/.github/actions/python-environment@1.4.0
+        uses: exasol/python-toolbox/.github/actions/python-environment@1.6.0
 
       - name: Check Tag Version
         # make sure the pushed/created tag matched the project version
diff --git a/.github/workflows/checks.yml b/.github/workflows/checks.yml
@@ -16,7 +16,7 @@ jobs:
           fetch-depth: 0
 
       - name: Setup Python & Poetry Environment
-        uses: exasol/python-toolbox/.github/actions/python-environment@1.4.0
+        uses: exasol/python-toolbox/.github/actions/python-environment@1.6.0
 
       - name: Check Version(s)
         run: poetry run -- nox -s version:check
@@ -32,12 +32,16 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Setup Python & Poetry Environment
-        uses: exasol/python-toolbox/.github/actions/python-environment@1.4.0
+        uses: exasol/python-toolbox/.github/actions/python-environment@1.6.0
 
       - name: Build Documentation
         run: |
           poetry run -- nox -s docs:build
 
+      - name: Link Check
+        run: |
+          poetry run -- nox -s links:check
+
   build-matrix:
     name: Generate Build Matrix
     uses: ./.github/workflows/matrix-python.yml
@@ -55,7 +59,7 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Setup Python & Poetry Environment
-        uses: exasol/python-toolbox/.github/actions/python-environment@1.4.0
+        uses: exasol/python-toolbox/.github/actions/python-environment@1.6.0
 
       - name: Run changelog update check
         run: poetry run -- nox -s changelog:updated
@@ -74,7 +78,7 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Setup Python & Poetry Environment
-        uses: exasol/python-toolbox/.github/actions/python-environment@1.4.0
+        uses: exasol/python-toolbox/.github/actions/python-environment@1.6.0
         with:
           python-version: ${{ matrix.python-version }}
 
@@ -105,7 +109,7 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Setup Python & Poetry Environment
-        uses: exasol/python-toolbox/.github/actions/python-environment@1.4.0
+        uses: exasol/python-toolbox/.github/actions/python-environment@1.6.0
         with:
           python-version: ${{ matrix.python-version }}
 
@@ -127,7 +131,7 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Setup Python & Poetry Environment
-        uses: exasol/python-toolbox/.github/actions/python-environment@1.4.0
+        uses: exasol/python-toolbox/.github/actions/python-environment@1.6.0
         with:
           python-version: ${{ matrix.python-version }}
 
@@ -151,7 +155,7 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Setup Python & Poetry Environment
-        uses: exasol/python-toolbox/.github/actions/python-environment@1.4.0
+        uses: exasol/python-toolbox/.github/actions/python-environment@1.6.0
 
       - name: Run format check
         run: poetry run -- nox -s project:format
@@ -173,7 +177,7 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Setup Python & Poetry Environment
-        uses: exasol/python-toolbox/.github/actions/python-environment@1.4.0
+        uses: exasol/python-toolbox/.github/actions/python-environment@1.6.0
         with:
           python-version: ${{ matrix.python-version }}
 
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -1,14 +1,10 @@
 name: CI
 
 on:
-  push:
-    branches-ignore:
-      - "github-pages/*"
-      - "gh-pages/*"
-      - "main"
-      - "master"
+  pull_request:
+      types: [opened, synchronize, reopened]
   schedule:
-    # "At 00:00 on every 7th day-of-month from 1 through 31." (https://crontab.guru)
+    # At 00:00 on every 7th day-of-month from 1 through 31. (https://crontab.guru)
     - cron: "0 0 1/7 * *"
 
 jobs:
@@ -22,5 +18,6 @@ jobs:
   Metrics:
     needs: [ CI ]
     uses: ./.github/workflows/report.yml
+    secrets: inherit
     permissions:
       contents: read
diff --git a/.github/workflows/gh-pages.yml b/.github/workflows/gh-pages.yml
@@ -17,7 +17,7 @@ jobs:
           fetch-depth: 0
 
       - name: Setup Python & Poetry Environment
-        uses: exasol/python-toolbox/.github/actions/python-environment@1.4.0
+        uses: exasol/python-toolbox/.github/actions/python-environment@1.6.0
 
       - name: Build Documentation
         run: |
diff --git a/.github/workflows/matrix-python.yml b/.github/workflows/matrix-python.yml
@@ -17,7 +17,7 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Setup Python & Poetry Environment
-        uses: exasol/python-toolbox/.github/actions/python-environment@1.4.0
+        uses: exasol/python-toolbox/.github/actions/python-environment@1.6.0
 
       - name: Generate matrix
         run: poetry run -- nox -s matrix:python
diff --git a/.github/workflows/pr-merge.yml b/.github/workflows/pr-merge.yml
@@ -28,5 +28,6 @@ jobs:
   metrics:
     needs: [ ci-job ]
     uses: ./.github/workflows/report.yml
+    secrets: inherit
     permissions:
       contents: read
diff --git a/.github/workflows/report.yml b/.github/workflows/report.yml
@@ -19,7 +19,7 @@ jobs:
           fetch-depth: 0
 
       - name: Setup Python & Poetry Environment
-        uses: exasol/python-toolbox/.github/actions/python-environment@1.4.0
+        uses: exasol/python-toolbox/.github/actions/python-environment@1.6.0
 
       - name: Download Artifacts
         uses: actions/download-artifact@v4.2.1
@@ -32,6 +32,11 @@ jobs:
       - name: Validate Artifacts
         run: poetry run -- nox -s artifacts:validate
 
+      - name: Upload to sonar
+        env:
+          SONAR_TOKEN: "${{ secrets.SONAR_TOKEN }}"
+        run: poetry run -- nox -s sonar:check
+
       - name: Generate Report
         run: poetry run -- nox -s project:report -- --format json | tee metrics.json
 
diff --git a/.github/workflows/slow-checks.yml b/.github/workflows/slow-checks.yml
@@ -19,7 +19,7 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Setup Python & Poetry Environment
-        uses: exasol/python-toolbox/.github/actions/python-environment@1.4.0
+        uses: exasol/python-toolbox/.github/actions/python-environment@1.6.0
         with:
           python-version: ${{ matrix.python-version }}
 
diff --git a/README.rst b/README.rst
@@ -22,15 +22,15 @@ Exasol Bucketfs
     :alt: Formatter - Isort
 
 .. image:: https://img.shields.io/pypi/l/exasol-bucketfs
-     :target: https://opensource.org/licenses/MIT
+     :target: https://opensource.org/license/MIT
      :alt: License
 
 .. image:: https://img.shields.io/github/last-commit/exasol/bucketfs-python
      :target: https://pypi.org/project/exasol-bucketfs/
      :alt: Last Commit
 
 
-Exasol Bucketfs is a python library to interact with Exasol `Bucketfs-Service(s) <https://docs.exasol.com/db/latest/database_concepts/bucketfs/bucketfs.htm>`_.
+Exasol Bucketfs is a Python library to interact with Exasol `Bucketfs-Service(s) <https://docs.exasol.com/db/latest/database_concepts/bucketfs/bucketfs.htm>`_.
 
 🚀 Features
 ------------
@@ -42,10 +42,6 @@ Exasol Bucketfs is a python library to interact with Exasol `Bucketfs-Service(s)
 * Delete files from bucketfs
 * Pythonic API
 
-🔌️ Prerequisites
------------------
-
-- `Python <https://www.python.org/>`_ >= 3.8
 
 💾 Installation
 ----------------
diff --git a/doc/changes/changes_0.8.0.md b/doc/changes/changes_0.8.0.md
@@ -10,7 +10,7 @@ Dependency updates
 
   Security vulnerabilities have been addressed, hence we advise users of
   our library to update and check the security of their own dependency tree.
-  E.g. by using a vulnerability scanner like [trivy](https://aquasecurity.github.io/trivy/v0.17.2/).
+  E.g. by using a vulnerability scanner like [trivy](https://trivy.dev/v0.17.2/).
 
 * Updated dependencies to address security issue (internal: poetry.lock)
   * CVE-2023-0286
diff --git a/doc/changes/unreleased.md b/doc/changes/unreleased.md
@@ -1 +1,5 @@
 # Unreleased
+
+# Security
+
+* #228: Relocked dependencies for CVE-2025-50182 and CVE-2025-50181 for transitive dependence `urllib3`
diff --git a/doc/conf.py b/doc/conf.py
@@ -78,3 +78,15 @@
     "github_url": "https://github.com/exasol/bucketfs-python",
     "accent_color": "grass",
 }
+# -- Configure link checking behavior  ----------------------------------------
+linkcheck_rate_limit_timeout = 60
+linkcheck_timeout = 15
+linkcheck_delay = 30
+linkcheck_retries = 2
+linkcheck_anchors = False
+linkcheck_ignore: list[str] = []
+linkcheck_allowed_redirects = {
+    # All HTTP redirections from the source URI to
+    # the canonical URI will be treated as "working".
+    r"https://github\.com/.*": r"https://github\.com/login*"
+}
diff --git a/doc/developer_guide/developer_guide.rst b/doc/developer_guide/developer_guide.rst
@@ -35,8 +35,8 @@ BFSPY declares a dependency to pytest plugin ``pytest-exasol-backend`` which is
 maintained in GitHub repository `pytest-plugins/pytest_backend
 <https://github.com/exasol/pytest-plugins/tree/main/pytest-backend/>`_.  This
 plugin makes additional fixtures available that are used in the saas
-integration tests of BFSPY, see files in folder `test_saas/integration
-<https://github.com/exasol/bucketfs-python/tree/main/test_saas/integration/>`_.
+integration tests of BFSPY, see files in folder `test_service_saas.py
+<https://github.com/exasol/bucketfs-python/blob/main/test/integration/test_service_saas.py>`_.
 
 Running Tests in CI Builds
 --------------------------
@@ -59,7 +59,7 @@ infrastructure which are creating costs for the database instances temporarily
 created during test execution.
 
 Group G2 is guarded by a dedicated `GitHub Enviroment
-<https://docs.github.com/en/actions/deployment/targeting-different-environments/using-environments-for-deployment#required-reviewers>`_
+<https://docs.github.com/en/actions/how-tos/managing-workflow-runs-and-deployments/managing-deployments/managing-environments-for-deployment#required-reviewers>`_
 requiring **manual approval** before these tests are executed.
 
 Each of the groups results in a final gating GitHub workflow job that is added to the branch protection of branch ``main``.
diff --git a/doc/examples/path_like.py b/doc/examples/path_like.py
@@ -5,7 +5,7 @@
 
 import os
 import tempfile
-from typing import ByteString
+from collections.abc import ByteString
 
 import exasol.bucketfs as bfs
 
diff --git a/exasol/bucketfs/_buckets.py b/exasol/bucketfs/_buckets.py
@@ -3,13 +3,15 @@
 import errno
 import os
 import shutil
+from collections.abc import (
+    ByteString,
+    Iterable,
+    Iterator,
+)
 from io import IOBase
 from pathlib import Path
 from typing import (
     BinaryIO,
-    ByteString,
-    Iterable,
-    Iterator,
     Optional,
     Protocol,
 )
diff --git a/exasol/bucketfs/_convert.py b/exasol/bucketfs/_convert.py
@@ -1,11 +1,11 @@
 from __future__ import annotations
 
 import hashlib
-from pathlib import Path
-from typing import (
+from collections.abc import (
     ByteString,
     Iterable,
 )
+from pathlib import Path
 
 from exasol.bucketfs._error import BucketFsError
 
diff --git a/exasol/bucketfs/_path.py b/exasol/bucketfs/_path.py
@@ -2,6 +2,11 @@
 
 import errno
 import os
+from collections.abc import (
+    ByteString,
+    Generator,
+    Iterable,
+)
 from enum import (
     Enum,
     auto,
@@ -13,9 +18,6 @@
 )
 from typing import (
     BinaryIO,
-    ByteString,
-    Generator,
-    Iterable,
     Optional,
     Protocol,
 )
diff --git a/exasol/bucketfs/_service.py b/exasol/bucketfs/_service.py
@@ -1,10 +1,12 @@
 from __future__ import annotations
 
 from collections import defaultdict
-from typing import (
+from collections.abc import (
     Iterator,
     Mapping,
     MutableMapping,
+)
+from typing import (
     Optional,
 )
 
diff --git a/noxconfig.py b/noxconfig.py
@@ -1,20 +1,22 @@
 from __future__ import annotations
 
+from collections.abc import Iterable
 from dataclasses import dataclass
 from pathlib import Path
-from typing import Iterable
 
 
 @dataclass(frozen=True)
 class Config:
     root: Path = Path(__file__).parent
     doc: Path = Path(__file__).parent / "doc"
+    source: Path = Path("exasol/bucketfs")
     version_file: Path = Path(__file__).parent / "exasol" / "bucketfs" / "version.py"
     path_filters: Iterable[str] = (
         "dist",
         ".eggs",
         "venv",
     )
+    python_versions = ["3.10", "3.11", "3.12", "3.13"]
 
 
 PROJECT_CONFIG = Config()
diff --git a/poetry.lock b/poetry.lock
diff --git a/pyproject.toml b/pyproject.toml
diff --git a/test/integration/conftest.py b/test/integration/conftest.py
diff --git a/test/integration/test_path.py b/test/integration/test_path.py
diff --git a/test/integration/test_service_onprem.py b/test/integration/test_service_onprem.py
