Fix 15 Dependabot security vulnerabilities#108
Merged
Conversation
Res260
force-pushed
the
fix-dependabot-security
branch
from
2835cf9 to
f43bae8
Compare
Adds a matrix strategy to the CI job so that the full deployment test runs against all three supported install methods. The poetry path uses poetry.lock (verifying pinned safe versions); pip and uv paths resolve from pyproject.toml constraints (verifying the new lower bounds added for black and requests). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Signed-off-by: Émilio Gonzalez <little.moon6016@fastmail.com>
uv pip install in a bare shell doesn't reliably pick up the manually created .venv, causing extras like pybadges/matplotlib to be missed. uv sync --extra workflow always installs into .venv and is the idiomatic way to install a project with extras using uv. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
uv sync installs into an isolated .venv using uv's managed Python, so the ctf script's shebang can point to a different Python than the one with pybadges in its sys.path. Using --system installs into the same Python environment as pip does, making ctf and all its extras available without any PATH or venv management. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
--system fails on ubuntu-24.04 due to PEP 668 (externally managed Python). pip install works because it targets GitHub Actions' managed Python environment, not the system Python. Creating the venv with python3 -m venv uses that same Python; uv auto-detects .venv and installs into it, so ctf and pybadges share the same interpreter. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
python3 -m venv creates symlinks by default: .venv/bin/python3 points to /usr/bin/python3. When uv generates the ctf console script it resolves that symlink and writes #!/usr/bin/python3 as the shebang. Python then starts outside the venv directory, never finds pyvenv.cfg, skips venv activation, and sys.path excludes .venv site-packages — so pybadges is installed but invisible. --copies puts a real binary at .venv/bin/python3.12. uv writes that path as the shebang; Python finds pyvenv.cfg next to it and activates the venv correctly. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Root cause of the uv CI failure: pybadges imports pkg_resources, which setuptools >= 81 no longer ships. This was never a uv venv/shebang issue — the earlier --copies/--system/uv sync attempts were red herrings. Why only uv failed: - poetry.lock pinned setuptools 80.9.0 (< 81) -> poetry passed - pip used the runner's preinstalled old setuptools -> passed by luck - uv.lock pinned setuptools 82.0.1 (>= 81) -> pybadges import failed with "No module named 'pkg_resources'", surfaced as "Module pybadges was not found" in ctf stats --generate-badges Pin setuptools<81 in the workflow extra (where pybadges lives, so the constraint is self-documenting) and regenerate both lockfiles. Verified end-to-end: uv run --locked + bare `ctf stats --generate-badges` now generates badges successfully. Also switch the poetry CI step to `poetry sync` for a clean environment. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
black>=26.3.1andrequests>=2.33.0lower bounds topyproject.tomlso pip/uv/pipx installs also get safe versions (not just Poetry)Resolves Dependabot alerts #3, #4, #5, #6, #7, #8, #10, #11, #12, #13, #14, #15, #16, #17, #18.
Test plan
🤖 Generated with Claude Code
Autre change: ajout d'une matrix pour tester uv, pip et poetry dans le CI au lieu de juste pip. Ça nous assure que peu importe la méthode d'installation,
ctffonctionne correctement