Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Replace outdated dependency with security flags #305

Open
wants to merge 5 commits into
base: main
Choose a base branch
from

Conversation

shcheklein
Copy link

pytest-celery raises security scan alert (e.g. https://github.com/iterative/dvc-task/actions/runs/8883067284/job/24389104408?pr=128)

It depends on retry libm which itself depends (for no good reason) on py which is flagged for security and is outdated:

invl/retry#58
invl/retry#60

It seems it's not maintained (last release / update is ~8 years ago).

A replacement is funcy - lightweight (no dependencies AFAIK), license is good, maintained. We have been using it in DVC.org for a while.

Copy link

codecov bot commented Apr 30, 2024

Codecov Report

Attention: Patch coverage is 0% with 2 lines in your changes are missing coverage. Please review.

Project coverage is 25.27%. Comparing base (ed8616f) to head (3ab2185).

Files Patch % Lines
src/pytest_celery/api/container.py 0.00% 2 Missing ⚠️
Additional details and impacted files
@@           Coverage Diff           @@
##             main     #305   +/-   ##
=======================================
  Coverage   25.27%   25.27%           
=======================================
  Files          37       37           
  Lines        1187     1187           
  Branches      235      235           
=======================================
  Hits          300      300           
  Misses        859      859           
  Partials       28       28           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@shcheklein
Copy link
Author

hey @Nusnus, thanks for running the pipeline for this 🙏 . Let me know if you need anything here or is it good to go as is.

@Nusnus
Copy link
Member

Nusnus commented Apr 30, 2024

hey @Nusnus, thanks for running the pipeline for this 🙏 . Let me know if you need anything here or is it good to go as is.

Thanks for the PR!
I have a very busy week and many PRs to review, but I will sure get to everything as soon as I can.

I’ll let you know if anything else is needed, thank you!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants