From cd00d14c1fdb8349d21806ae1e0fc4549dbbb73a Mon Sep 17 00:00:00 2001 From: Carlo Costino Date: Wed, 17 Apr 2024 18:02:21 -0400 Subject: [PATCH 1/2] Update gunicorn to latest release This changeset updates the gunicorn dependency to the latest release to address a recent CVE. Signed-off-by: Carlo Costino --- .github/workflows/checks.yml | 2 -- poetry.lock | 15 ++++++++------- pyproject.toml | 2 +- 3 files changed, 9 insertions(+), 10 deletions(-) diff --git a/.github/workflows/checks.yml b/.github/workflows/checks.yml index 402404b29..ca05cde57 100644 --- a/.github/workflows/checks.yml +++ b/.github/workflows/checks.yml @@ -89,8 +89,6 @@ jobs: - uses: pypa/gh-action-pip-audit@v1.0.8 with: inputs: requirements.txt - ignore-vulns: | - GHSA-w3h3-4rj7-4ph4 static-scan: runs-on: ubuntu-latest diff --git a/poetry.lock b/poetry.lock index b0b1e95c4..56be37dda 100644 --- a/poetry.lock +++ b/poetry.lock @@ -1635,23 +1635,24 @@ test = ["objgraph", "psutil"] [[package]] name = "gunicorn" -version = "21.2.0" +version = "22.0.0" description = "WSGI HTTP Server for UNIX" optional = false -python-versions = ">=3.5" +python-versions = ">=3.7" files = [ - {file = "gunicorn-21.2.0-py3-none-any.whl", hash = "sha256:3213aa5e8c24949e792bcacfc176fef362e7aac80b76c56f6b5122bf350722f0"}, - {file = "gunicorn-21.2.0.tar.gz", hash = "sha256:88ec8bff1d634f98e61b9f65bc4bf3cd918a90806c6f5c48bc5603849ec81033"}, + {file = "gunicorn-22.0.0-py3-none-any.whl", hash = "sha256:350679f91b24062c86e386e198a15438d53a7a8207235a78ba1b53df4c4378d9"}, + {file = "gunicorn-22.0.0.tar.gz", hash = "sha256:4a0b436239ff76fb33f11c07a16482c521a7e09c1ce3cc293c2330afe01bec63"}, ] [package.dependencies] -eventlet = {version = ">=0.24.1", optional = true, markers = "extra == \"eventlet\""} +eventlet = {version = ">=0.24.1,<0.36.0 || >0.36.0", optional = true, markers = "extra == \"eventlet\""} packaging = "*" [package.extras] -eventlet = ["eventlet (>=0.24.1)"] +eventlet = ["eventlet (>=0.24.1,!=0.36.0)"] gevent = ["gevent (>=1.4.0)"] setproctitle = ["setproctitle"] +testing = ["coverage", "eventlet", "gevent", "pytest", "pytest-cov"] tornado = ["tornado (>=0.2)"] [[package]] @@ -4800,4 +4801,4 @@ multidict = ">=4.0" [metadata] lock-version = "2.0" python-versions = "^3.12.2" -content-hash = "dcbbd4dd7bd9336e8c13f171c9dfe7e54194254c87d10711b1cd7748d38ce19c" +content-hash = "ac4a9cfb1ee9b5d8824385113cc825e55aefa8ad599649bde17b0333ed304dcd" diff --git a/pyproject.toml b/pyproject.toml index 47b6f1d58..c22cc6933 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -33,7 +33,7 @@ flask-marshmallow = "==0.14.0" flask-migrate = "==4.0.7" flask-redis = "==0.4.0" flask-sqlalchemy = "==3.0.5" -gunicorn = {version = "==21.2.0", extras = ["eventlet"]} +gunicorn = {version = "==22.0.0", extras = ["eventlet"]} iso8601 = "==2.1.0" jsonschema = {version = "==4.20.0", extras = ["format"]} lxml = "==5.2.1" From 9ec75c57c837c4077059e4dc0126b5e9f790a88c Mon Sep 17 00:00:00 2001 From: Kenneth Kehl <@kkehl@flexion.us> Date: Thu, 18 Apr 2024 08:49:14 -0700 Subject: [PATCH 2/2] remove check-db-notification-fails task from schedule --- app/config.py | 5 ----- poetry.lock | 2 ++ 2 files changed, 2 insertions(+), 5 deletions(-) diff --git a/app/config.py b/app/config.py index 232dc7ac8..809a71ebe 100644 --- a/app/config.py +++ b/app/config.py @@ -199,11 +199,6 @@ class Config(object): "schedule": timedelta(minutes=66), "options": {"queue": QueueNames.PERIODIC}, }, - "check-db-notification-fails": { - "task": "check-db-notification-fails", - "schedule": crontab(minute="18, 48"), - "options": {"queue": QueueNames.PERIODIC}, - }, "check-job-status": { "task": "check-job-status", "schedule": crontab(), diff --git a/poetry.lock b/poetry.lock index 56be37dda..f64aebdac 100644 --- a/poetry.lock +++ b/poetry.lock @@ -2072,6 +2072,7 @@ files = [ {file = "lxml-5.2.1-cp36-cp36m-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:c38d7b9a690b090de999835f0443d8aa93ce5f2064035dfc48f27f02b4afc3d0"}, {file = "lxml-5.2.1-cp36-cp36m-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:5670fb70a828663cc37552a2a85bf2ac38475572b0e9b91283dc09efb52c41d1"}, {file = "lxml-5.2.1-cp36-cp36m-manylinux_2_28_x86_64.whl", hash = "sha256:958244ad566c3ffc385f47dddde4145088a0ab893504b54b52c041987a8c1863"}, + {file = "lxml-5.2.1-cp36-cp36m-manylinux_2_5_x86_64.manylinux1_x86_64.whl", hash = "sha256:b6241d4eee5f89453307c2f2bfa03b50362052ca0af1efecf9fef9a41a22bb4f"}, {file = "lxml-5.2.1-cp36-cp36m-musllinux_1_1_aarch64.whl", hash = "sha256:2a66bf12fbd4666dd023b6f51223aed3d9f3b40fef06ce404cb75bafd3d89536"}, {file = "lxml-5.2.1-cp36-cp36m-musllinux_1_1_ppc64le.whl", hash = "sha256:9123716666e25b7b71c4e1789ec829ed18663152008b58544d95b008ed9e21e9"}, {file = "lxml-5.2.1-cp36-cp36m-musllinux_1_1_s390x.whl", hash = "sha256:0c3f67e2aeda739d1cc0b1102c9a9129f7dc83901226cc24dd72ba275ced4218"}, @@ -2489,6 +2490,7 @@ files = [ {file = "msgpack-1.0.8-cp39-cp39-musllinux_1_1_x86_64.whl", hash = "sha256:5fbb160554e319f7b22ecf530a80a3ff496d38e8e07ae763b9e82fadfe96f273"}, {file = "msgpack-1.0.8-cp39-cp39-win32.whl", hash = "sha256:f9af38a89b6a5c04b7d18c492c8ccf2aee7048aff1ce8437c4683bb5a1df893d"}, {file = "msgpack-1.0.8-cp39-cp39-win_amd64.whl", hash = "sha256:ed59dd52075f8fc91da6053b12e8c89e37aa043f8986efd89e61fae69dc1b011"}, + {file = "msgpack-1.0.8-py3-none-any.whl", hash = "sha256:24f727df1e20b9876fa6e95f840a2a2651e34c0ad147676356f4bf5fbb0206ca"}, {file = "msgpack-1.0.8.tar.gz", hash = "sha256:95c02b0e27e706e48d0e5426d1710ca78e0f0628d6e89d5b5a5b91a5f12274f3"}, ]