From 45607333b100b63b1a7da0f0228e1ef858bd7a47 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Micha=C5=82=20Pasternak?= Date: Wed, 19 Aug 2026 00:38:08 +0200 Subject: [PATCH] =?UTF-8?q?fix(deps):=20sqlparse=20>=3D=200.6.0=20?= =?UTF-8?q?=E2=80=94=20cztery=20fixable=20CVE=20zamykaja=20gate=20pip-audi?= =?UTF-8?q?t?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `pip-audit scan` (workflow "Dependency vulnerability scan") pada na kazdym PR-ze i na dev: sqlparse 0.5.5 ma CVE-2026-71491, CVE-2026-59894, CVE-2026-59893 i CVE-2026-54284. Wszystkie sa fixable (fix: 0.6.0), a gate jest wlasnie "on fixable", wiec blokuje. To nie regresja z zadnego PR-a — advisories doszly po ostatnim zielonym przebiegu na dev (2026-08-17), wiec dev jest tak samo czerwony przy najblizszym uruchomieniu. Stad osobna zmiana zamiast doklejania jej do feature-brancha, ktory tylko na nia trafil. sqlparse jest zalezoscia przechodnia Django (sqlmigrate, formatowanie SQL w debugu); pin istnieje wylacznie po to, zeby wymusic wersje z fixem — tak samo jak poprzedni >=0.5.4 wymuszal fix DoS w format_list_of_tuples. Lock przebudowany uv 0.11.29 (wersja z CI), zeby diff obejmowal sam sqlparse zamiast przepisywac plik do innego formatu markerow. Bez newsfragmentu: bump przechodniej zaleznosci, zero zmian widocznych dla uzytkownika. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01WSUsgzYoDNnXpXGAn5otJg --- pyproject.toml | 6 +++++- uv.lock | 8 ++++---- 2 files changed, 9 insertions(+), 5 deletions(-) diff --git a/pyproject.toml b/pyproject.toml index 8efd07de8..57264473c 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -145,7 +145,11 @@ dependencies = [ "beautifulsoup4>=4.15.0", # importer_publikacji.providers.www imports at app-ready time "gunicorn>=26.0.0", # authserver WSGI runner (moved from docker/authserver build-time uv pip install) "watchdog>=5.0.3", # --reload mode dla uvicorn/celery w dev compose (moved from entrypoint `uv pip install`) - "sqlparse>=0.5.4", # Dependabot: transitive via Django, bumped to fix DoS in format_list_of_tuples + # Transitive via Django, pinowany zeby wymusic wersje z fixem. 0.6.0 zamyka + # CVE-2026-71491, CVE-2026-59894, CVE-2026-59893 i CVE-2026-54284 (wszystkie + # fixable, wiec `pip-audit --gate on fixable` na nich pada); 0.5.4 wnosil + # wczesniejszy fix DoS w format_list_of_tuples. + "sqlparse>=0.6.0", "django-channels-broadcast>=0.3.0", "django-countdown>=0.3.1", "django-formdefaults>=0.6.3", diff --git a/uv.lock b/uv.lock index b26090fd7..e6bcace18 100644 --- a/uv.lock +++ b/uv.lock @@ -667,7 +667,7 @@ requires-dist = [ { name = "rjsmin", specifier = ">=1.2.1" }, { name = "rollbar", specifier = ">=1.4.0" }, { name = "simplejson", specifier = ">=4.1.1,<5" }, - { name = "sqlparse", specifier = ">=0.5.4" }, + { name = "sqlparse", specifier = ">=0.6.0" }, { name = "tablib", specifier = "==3.10.0" }, { name = "testcontainers", extras = ["postgres"], marker = "extra == 'baseline-rebuild'", specifier = ">=4.15.0" }, { name = "thefuzz", specifier = ">=0.22.1" }, @@ -5672,11 +5672,11 @@ wheels = [ [[package]] name = "sqlparse" -version = "0.5.5" +version = "0.6.0" source = { registry = "https://pypi.org/simple" } -sdist = { url = "https://files.pythonhosted.org/packages/90/76/437d71068094df0726366574cf3432a4ed754217b436eb7429415cf2d480/sqlparse-0.5.5.tar.gz", hash = "sha256:e20d4a9b0b8585fdf63b10d30066c7c94c5d7a7ec47c889a2d83a3caa93ff28e", size = 120815, upload-time = "2025-12-19T07:17:45.073Z" } +sdist = { url = "https://files.pythonhosted.org/packages/5f/d3/3f06a1006f2261d1342aefb3c71eed02f5d4ca5bdbecd86ebc12ad38306e/sqlparse-0.6.0.tar.gz", hash = "sha256:113c35c75365ab9cc9c7231d68c6428fb11c085fc8e9eb1ad659b7ddbf6cd2b9", size = 178477, upload-time = "2026-08-13T19:16:06.396Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/49/4b/359f28a903c13438ef59ebeee215fb25da53066db67b305c125f1c6d2a25/sqlparse-0.5.5-py3-none-any.whl", hash = "sha256:12a08b3bf3eec877c519589833aed092e2444e68240a3577e8e26148acc7b1ba", size = 46138, upload-time = "2025-12-19T07:17:46.573Z" }, + { url = "https://files.pythonhosted.org/packages/d9/50/f00935da0ec7cbf325f8dc4f772ae46fbc7b672dd62876e73f0a94adda57/sqlparse-0.6.0-py3-none-any.whl", hash = "sha256:b861c0288ce2fa56209a9a6412d2e066ac664b3873b89c26c9d8415e8e32996f", size = 50070, upload-time = "2026-08-13T19:16:04.062Z" }, ] [[package]]