From dc35bdcedc8f36378ca0c38a71652fde60ce9cef Mon Sep 17 00:00:00 2001 From: mike cullerton Date: Thu, 7 Nov 2024 10:06:10 -0500 Subject: [PATCH 1/8] updates for dependabot --- Pipfile | 1 + Pipfile.lock | 3 ++- deploy/requirements.txt | 12 ++++++------ 3 files changed, 9 insertions(+), 7 deletions(-) diff --git a/Pipfile b/Pipfile index ace5ea32..0d23cc37 100644 --- a/Pipfile +++ b/Pipfile @@ -54,6 +54,7 @@ dateparser = "*" # TIP: If you want to test local changes to SpiffWorkflow, do: # pipenv install --editable ../SpiffWorkflow (but fix things back before commiting!) spiffworkflow = {git = "https://github.com/sartography/SpiffWorkflow@dd0eba278dc61438aea7cfb51e67c9f00b3f2db7"} +waitress = "*" [requires] python_version = "3.9" diff --git a/Pipfile.lock b/Pipfile.lock index f63fe3ed..cdcd8b1c 100644 --- a/Pipfile.lock +++ b/Pipfile.lock @@ -1,7 +1,7 @@ { "_meta": { "hash": { - "sha256": "638d48e8d09a02dd0ecf76689d862b0050a81eb8bd00c6a71b4d0016b9610ecc" + "sha256": "66927d49ad75ad6835cf81e14f3ff0eacfff1456a55b0b8be0e4aa32c5b09939" }, "pipfile-spec": 6, "requires": { @@ -1751,6 +1751,7 @@ "sha256:26cdbc593093a15119351690752c99adc13cbc6786d75f7b6341d1234a3730ac", "sha256:ef0c1f020d9f12a515c4ec65c07920a702613afcad1dbfdc3bcec256b6c072b3" ], + "index": "pypi", "markers": "python_full_version >= '3.9.0'", "version": "==3.0.1" }, diff --git a/deploy/requirements.txt b/deploy/requirements.txt index 23d74c50..5aa73f1f 100644 --- a/deploy/requirements.txt +++ b/deploy/requirements.txt @@ -6,7 +6,7 @@ babel==2.9.1 bcrypt==3.2.0 beautifulsoup4==4.9.3 blinker==1.4 -certifi==2022.12.7 +certifi==2024.08.30 cffi==1.14.4 chardet==3.0.4 click==7.1.2 @@ -21,7 +21,7 @@ et-xmlfile==1.0.1 flask==1.1.2 flask-admin==1.5.7 flask-bcrypt==0.7.1 -flask-cors==3.0.9 +flask-cors==5.0.0 flask-mail==0.9.1 flask-marshmallow==0.14.0 flask-migrate==2.5.3 @@ -65,7 +65,7 @@ pytz==2020.4 pyyaml==5.4 recommonmark==0.6.0 requests==2.25.0 -sentry-sdk==0.14.4 +sentry-sdk==2.8.0 six==1.15.0 snowballstemmer==2.0.0 soupsieve==2.0.1 @@ -80,10 +80,10 @@ spiffworkflow sqlalchemy==1.3.20 swagger-ui-bundle==0.0.8 urllib3==1.26.5 -waitress==2.1.2 -webob==1.8.6 +waitress==3.0.1 +webob==1.8.8 webtest==2.0.35 -werkzeug==1.0.1 +werkzeug==2.2.3 wrapt==1.12.1 wtforms==2.3.3 xlrd==1.2.0 From 3661429479e14df377e651f38a093b7bfe3e8387 Mon Sep 17 00:00:00 2001 From: mike cullerton Date: Thu, 7 Nov 2024 10:14:04 -0500 Subject: [PATCH 2/8] updated requirements.txt --- deploy/requirements.txt | 184 +++++++++++++++++++++++----------------- 1 file changed, 104 insertions(+), 80 deletions(-) diff --git a/deploy/requirements.txt b/deploy/requirements.txt index 5aa73f1f..acefc474 100644 --- a/deploy/requirements.txt +++ b/deploy/requirements.txt @@ -1,90 +1,114 @@ -alabaster==0.7.12 -alembic==1.4.3 -aniso8601==8.0.0 -attrs==20.3.0 -babel==2.9.1 -bcrypt==3.2.0 -beautifulsoup4==4.9.3 -blinker==1.4 -certifi==2024.08.30 -cffi==1.14.4 -chardet==3.0.4 -click==7.1.2 +alabaster==0.7.16 +alembic==1.14.0 +amqp==5.2.0 +aniso8601==9.0.1 +apscheduler==3.10.4 +attrs==24.2.0 +babel==2.16.0 +bcrypt==4.2.0 +beautifulsoup4==4.12.3 +billiard==4.2.1 +blinker==1.8.2 +celery==5.4.0 +certifi==2024.8.30 +cffi==1.17.1 +charset-normalizer==3.4.0 +click==8.1.7 +click-didyoumean==0.3.1 +click-plugins==1.1.1 +click-repl==0.3.0 clickclick==20.10.2 commonmark==0.9.1 -connexion==2.7.0 -coverage==5.3 -deprecated==1.2.10 -docutils==0.16 -docxtpl==0.11.2 -et-xmlfile==1.0.1 -flask==1.1.2 -flask-admin==1.5.7 -flask-bcrypt==0.7.1 +configparser==7.1.0 +connexion==2.14.2 +coverage==7.6.4 +cryptography==43.0.3 +dateparser==1.2.0 +deprecated==1.2.14 +docutils==0.21.2 +docxcompose==1.4.0 +docxtpl==0.18.0 +et-xmlfile==2.0.0 +flask==2.2.5 +flask-admin==1.6.1 +flask-bcrypt==1.0.1 flask-cors==5.0.0 -flask-mail==0.9.1 -flask-marshmallow==0.14.0 -flask-migrate==2.5.3 -flask-restful==0.3.8 -flask-sqlalchemy==2.4.4 -gunicorn==20.0.4 -httpretty==1.0.3 -idna==2.10 -imagesize==1.2.0 +flask-mail==0.10.0 +flask-marshmallow==1.2.1 +flask-migrate==4.0.7 +flask-restful==0.3.10 +flask-sqlalchemy==3.0.5 +gitdb==4.0.11 +gitpython==3.1.43 +gunicorn==23.0.0 +httpretty==1.1.4 +idna==3.10 +imagesize==1.4.1 +importlib-metadata==8.5.0 inflection==0.5.1 -itsdangerous==1.1.0 -jdcal==1.4.1 -jinja2==2.11.3 -jsonschema==3.2.0 -ldap3==2.8.1 -lxml==4.9.1 -mako==1.2.2 -markdown==3.3.3 -markupsafe==1.1.1 -marshmallow==3.9.1 +itsdangerous==2.2.0 +jinja2==3.1.4 +jsonschema==4.23.0 +jsonschema-specifications==2024.10.1 +kombu==5.4.2 +ldap3==2.9.1 +lxml==5.3.0 +mako==1.3.6 +markdown==3.7 +markupsafe==3.0.2 +marshmallow==3.23.1 marshmallow-enum==1.5.1 -marshmallow-sqlalchemy==0.24.1 -numpy==1.22.0 -openapi-spec-validator==0.2.9 -openpyxl==3.0.5 -packaging==20.4 -pandas==1.1.4 -psycopg2-binary==2.8.6 -pyasn1==0.4.8 -pycparser==2.20 -pygithub==1.53 -pygments==2.7.4 -pyjwt==2.4.0 -pyparsing==2.4.7 -pyrsistent==0.17.3 -python-box==5.2.0 -python-dateutil==2.8.1 -python-docx==0.8.10 -python-editor==1.0.4 -pytz==2020.4 -pyyaml==5.4 -recommonmark==0.6.0 -requests==2.25.0 +marshmallow-sqlalchemy==1.1.0 +numpy==1.23.4 +openpyxl==3.1.5 +packaging==24.1 +pandas==1.5.1 +prompt-toolkit==3.0.48 +psycopg2-binary==2.9.10 +pyasn1==0.6.1 +pycparser==2.22 +pygithub==2.4.0 +pygments==2.18.0 +pyjwt==2.9.0 +pynacl==1.5.0 +python-dateutil==2.9.0.post0 +python-docx==1.1.2 +pytz==2024.2 +pyyaml==6.0.2 +recommonmark==0.7.1 +referencing==0.35.1 +regex==2024.9.11 +requests==2.32.3 +rpds-py==0.21.0 sentry-sdk==2.8.0 -six==1.15.0 -snowballstemmer==2.0.0 -soupsieve==2.0.1 -sphinx==3.3.1 -sphinxcontrib-applehelp==1.0.2 -sphinxcontrib-devhelp==1.0.2 -sphinxcontrib-htmlhelp==1.0.3 +setuptools==75.3.0 +six==1.16.0 +smmap==5.0.1 +snowballstemmer==2.2.0 +soupsieve==2.6 +sphinx==7.4.7 +sphinxcontrib-applehelp==2.0.0 +sphinxcontrib-devhelp==2.0.0 +sphinxcontrib-htmlhelp==2.1.0 sphinxcontrib-jsmath==1.0.1 -sphinxcontrib-qthelp==1.0.3 -sphinxcontrib-serializinghtml==1.1.4 +sphinxcontrib-qthelp==2.0.0 +sphinxcontrib-serializinghtml==2.0.0 spiffworkflow -sqlalchemy==1.3.20 -swagger-ui-bundle==0.0.8 -urllib3==1.26.5 +sqlalchemy==1.4.54 +swagger-ui-bundle==0.0.9 +tomli==2.0.2 +typing-extensions==4.12.2 +tzdata==2024.2 +tzlocal==5.2 +urllib3==2.2.3 +vine==5.1.0 waitress==3.0.1 -webob==1.8.8 -webtest==2.0.35 +wcwidth==0.2.13 +webob==1.8.9 +webtest==3.0.1 werkzeug==2.2.3 -wrapt==1.12.1 -wtforms==2.3.3 -xlrd==1.2.0 -xlsxwriter==1.3.7 +wrapt==1.16.0 +wtforms==3.2.1 +xlrd==2.0.1 +xlsxwriter==3.2.0 +zipp==3.20.2 From 95b484678dbd993e7313f9b8a815bdff4d972f6a Mon Sep 17 00:00:00 2001 From: mike cullerton Date: Thu, 7 Nov 2024 11:37:06 -0500 Subject: [PATCH 3/8] update checkout from v2 to v4 --- .github/workflows/build_image_from_dev.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/build_image_from_dev.yml b/.github/workflows/build_image_from_dev.yml index 0b0d07fc..a4a5bc5f 100644 --- a/.github/workflows/build_image_from_dev.yml +++ b/.github/workflows/build_image_from_dev.yml @@ -20,7 +20,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout repository - uses: actions/checkout@v2 + uses: actions/checkout@v4 with: # Disabling shallow clone is recommended for improving relevancy of reporting fetch-depth: 0 @@ -49,7 +49,7 @@ jobs: - 5432:5432 steps: - name: Checkout repository - uses: actions/checkout@v2 + uses: actions/checkout@v4 - uses: browser-actions/setup-chrome@latest with: chrome-version: stable From 8626bfe8b27e48c4527239dba3525cc6a98e47f4 Mon Sep 17 00:00:00 2001 From: mike cullerton Date: Thu, 7 Nov 2024 11:49:29 -0500 Subject: [PATCH 4/8] more action version updates --- .github/workflows/build_image_from_dev.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/build_image_from_dev.yml b/.github/workflows/build_image_from_dev.yml index a4a5bc5f..826f9a83 100644 --- a/.github/workflows/build_image_from_dev.yml +++ b/.github/workflows/build_image_from_dev.yml @@ -53,7 +53,7 @@ jobs: - uses: browser-actions/setup-chrome@latest with: chrome-version: stable - - uses: actions/setup-python@v3 + - uses: actions/setup-python@v5 with: python-version: '3.9' architecture: 'x64' @@ -83,7 +83,7 @@ jobs: ref: dev - name: Log in to the Container registry - uses: docker/login-action@f054a8b539a109f9f41c372932f1ae047eff08c9 + uses: docker/login-action@v3 with: registry: ${{ env.REGISTRY }} username: ${{ github.actor }} From a996d2d986823656b0af2fd2b07448726b64f896 Mon Sep 17 00:00:00 2001 From: mike cullerton Date: Thu, 7 Nov 2024 12:02:36 -0500 Subject: [PATCH 5/8] update action versions --- .github/workflows/create-docker-action.yml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/create-docker-action.yml b/.github/workflows/create-docker-action.yml index 44712d49..72cea93b 100644 --- a/.github/workflows/create-docker-action.yml +++ b/.github/workflows/create-docker-action.yml @@ -19,7 +19,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout repository - uses: actions/checkout@v2 + uses: actions/checkout@v4 with: # Disabling shallow clone is recommended for improving relevancy of reporting fetch-depth: 0 @@ -48,11 +48,11 @@ jobs: - 5432:5432 steps: - name: Checkout repository - uses: actions/checkout@v2 + uses: actions/checkout@v4 - uses: browser-actions/setup-chrome@latest with: chrome-version: stable - - uses: actions/setup-python@v3 + - uses: actions/setup-python@v5 with: python-version: '3.9' architecture: 'x64' @@ -74,10 +74,10 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v2 + uses: actions/checkout@v4 - name: Log in to the Container registry - uses: docker/login-action@f054a8b539a109f9f41c372932f1ae047eff08c9 + uses: docker/login-action@3 with: registry: ${{ env.REGISTRY }} username: ${{ github.actor }} From 33c5a9c7ffe9663ee0b1285a07cb74884bba13ed Mon Sep 17 00:00:00 2001 From: mike cullerton Date: Thu, 7 Nov 2024 12:13:54 -0500 Subject: [PATCH 6/8] update action versions for main branch --- .github/workflows/create-docker-action.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/create-docker-action.yml b/.github/workflows/create-docker-action.yml index 72cea93b..fa4783e9 100644 --- a/.github/workflows/create-docker-action.yml +++ b/.github/workflows/create-docker-action.yml @@ -77,7 +77,7 @@ jobs: uses: actions/checkout@v4 - name: Log in to the Container registry - uses: docker/login-action@3 + uses: docker/login-action@v3 with: registry: ${{ env.REGISTRY }} username: ${{ github.actor }} @@ -85,12 +85,12 @@ jobs: - name: Extract metadata (tags, labels) for Docker id: meta - uses: docker/metadata-action@98669ae865ea3cffbcbaa878cf57c20bbf1c6c38 + uses: docker/metadata-action@v5 with: images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} - name: Build and push Docker image - uses: docker/build-push-action@ad44023a93711e3deb337508980b4b5e9bcdc5dc + uses: docker/build-push-action@v6 with: context: . push: true From da7eaea5d4b3fe6ef8e0641cfb85c85bc2ffaf59 Mon Sep 17 00:00:00 2001 From: mike cullerton Date: Thu, 7 Nov 2024 12:23:10 -0500 Subject: [PATCH 7/8] missed one --- .github/workflows/build_image_from_dev.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/build_image_from_dev.yml b/.github/workflows/build_image_from_dev.yml index 826f9a83..4e603b2a 100644 --- a/.github/workflows/build_image_from_dev.yml +++ b/.github/workflows/build_image_from_dev.yml @@ -91,7 +91,7 @@ jobs: - name: Extract metadata (tags, labels) for Docker id: meta - uses: docker/metadata-action@98669ae865ea3cffbcbaa878cf57c20bbf1c6c38 + uses: docker/metadata-action@v5 with: images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} From d4ab9fbb18f7673e92e8ce838228699622955b7a Mon Sep 17 00:00:00 2001 From: mike cullerton Date: Thu, 7 Nov 2024 12:34:03 -0500 Subject: [PATCH 8/8] wrong version for docker build-push-action --- .github/workflows/build_image_from_dev.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/build_image_from_dev.yml b/.github/workflows/build_image_from_dev.yml index 4e603b2a..3353147d 100644 --- a/.github/workflows/build_image_from_dev.yml +++ b/.github/workflows/build_image_from_dev.yml @@ -97,7 +97,7 @@ jobs: - name: Build and push Docker image id: push - uses: docker/build-push-action@v4 + uses: docker/build-push-action@v6 with: context: . ref: dev