Skip to content

Commit

Permalink
Upgrade setuptools to fix CVE (#21314)
Browse files Browse the repository at this point in the history 
Closes #21184. This has the side effect of removing default tool
lockfile support for Python 3.7 by default; however, support can be
restored via creating [a custom tool
lockfile](https://www.pantsbuild.org/2.22/docs/python/overview/lockfiles#lockfiles-for-tools).
  • Loading branch information
@krishnan-chandra
krishnan-chandra authored Sep 13, 2024
1 parent a310f7b commit aff4bb2
Show file tree
Hide file tree
Showing 4 changed files with 74 additions and 67 deletions.
2 changes: 2 additions & 0 deletions docs/notes/2.24.x.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -30,6 +30,8 @@ The default lockfiles bundled with Pants for various tools (ex: to run `black`)

As a consequence of the lockfile generation, newer versions of many tools are now included in the default lockfiles.

The versions of `setuptools` and `wheel` used in Pants have been upgraded to `74.1.2` and `0.44.0` to address a remote code execution vulnerability in versions before setuptools `70.0`. This forces the minimum Python version to 3.8, in line with the changes mentioned above.


#### Shell

Expand Down
130 changes: 68 additions & 62 deletions src/python/pants/backend/python/subsystems/setuptools.lock
View file
Original file line number Diff line number Diff line change
Expand Up @@ -9,8 +9,8 @@
// "CPython<4,>=3.8"
// ],
// "generated_with_requirements": [
// "setuptools<64.0,>=63.1.0",
// "wheel<0.38,>=0.35.1"
// "setuptools>=70.0",
// "wheel>=0.40"
// ],
// "manylinux": "manylinux2014",
// "requirement_constraints": [],
Expand All @@ -33,85 +33,91 @@
"artifacts": [
{
"algorithm": "sha256",
"hash": "7f61f7e82647f77d4118eeaf43d64cbcd4d87e38af9611694d4866eb070cd10d",
"url": "https://files.pythonhosted.org/packages/2a/a3/49c29680d6118273b992b40ebe881e8e899b8e26a4e951f37f223da8f862/setuptools-63.4.3-py3-none-any.whl"
"hash": "5f4c08aa4d3ebcb57a50c33b1b07e94315d7fc7230f7115e47fc99776c8ce308",
"url": "https://files.pythonhosted.org/packages/cb/9c/9ad11ac06b97e55ada655f8a6bea9d1d3f06e120b178cd578d80e558191d/setuptools-74.1.2-py3-none-any.whl"
},
{
"algorithm": "sha256",
"hash": "521c833d1e5e1ef0869940e7f486a83de7773b9f029010ad0c2fe35453a9dad9",
"url": "https://files.pythonhosted.org/packages/5b/ff/69fd395c5237da934753752b71c38e95e137bd0603d5640df70ddaea8038/setuptools-63.4.3.tar.gz"
"hash": "95b40ed940a1c67eb70fc099094bd6e99c6ee7c23aa2306f4d2697ba7916f9c6",
"url": "https://files.pythonhosted.org/packages/3e/2c/f0a538a2f91ce633a78daaeb34cbfb93a54bd2132a6de1f6cec028eee6ef/setuptools-74.1.2.tar.gz"
}
],
"project_name": "setuptools",
"requires_dists": [
"build[virtualenv]; extra == \"testing\"",
"build[virtualenv]; extra == \"testing-integration\"",
"filelock>=3.4.0; extra == \"testing\"",
"filelock>=3.4.0; extra == \"testing-integration\"",
"flake8-2020; extra == \"testing\"",
"flake8<5; extra == \"testing\"",
"furo; extra == \"docs\"",
"ini2toml[lite]>=0.9; extra == \"testing\"",
"jaraco.envs>=2.2; extra == \"testing\"",
"jaraco.envs>=2.2; extra == \"testing-integration\"",
"jaraco.packaging>=9; extra == \"docs\"",
"jaraco.path>=3.2.0; extra == \"testing\"",
"jaraco.path>=3.2.0; extra == \"testing-integration\"",
"jaraco.tidelift>=1.4; extra == \"docs\"",
"mock; extra == \"testing\"",
"pip-run>=8.8; extra == \"testing\"",
"pip>=19.1; extra == \"testing\"",
"pygments-github-lexers==0.0.5; extra == \"docs\"",
"pytest-black>=0.3.7; platform_python_implementation != \"PyPy\" and extra == \"testing\"",
"pytest-checkdocs>=2.4; extra == \"testing\"",
"pytest-cov; platform_python_implementation != \"PyPy\" and extra == \"testing\"",
"pytest-enabler; extra == \"testing-integration\"",
"pytest-enabler>=1.3; extra == \"testing\"",
"pytest-flake8; extra == \"testing\"",
"pytest-mypy>=0.9.1; platform_python_implementation != \"PyPy\" and extra == \"testing\"",
"pytest-perf; extra == \"testing\"",
"pytest-xdist; extra == \"testing\"",
"pytest-xdist; extra == \"testing-integration\"",
"pytest; extra == \"testing-integration\"",
"pytest>=6; extra == \"testing\"",
"rst.linker>=1.9; extra == \"docs\"",
"sphinx-favicon; extra == \"docs\"",
"sphinx-hoverxref<2; extra == \"docs\"",
"sphinx-inline-tabs; extra == \"docs\"",
"sphinx-notfound-page==0.8.3; extra == \"docs\"",
"sphinx-reredirects; extra == \"docs\"",
"sphinx; extra == \"docs\"",
"sphinxcontrib-towncrier; extra == \"docs\"",
"tomli-w>=1.0.0; extra == \"testing\"",
"tomli; extra == \"testing-integration\"",
"virtualenv>=13.0.0; extra == \"testing\"",
"virtualenv>=13.0.0; extra == \"testing-integration\"",
"wheel; extra == \"testing\"",
"wheel; extra == \"testing-integration\""
"build[virtualenv]>=1.0.3; extra == \"test\"",
"filelock>=3.4.0; extra == \"test\"",
"furo; extra == \"doc\"",
"importlib-metadata>=6; python_version < \"3.10\" and extra == \"core\"",
"importlib-metadata>=7.0.2; python_version < \"3.10\" and extra == \"type\"",
"importlib-resources>=5.10.2; python_version < \"3.9\" and extra == \"core\"",
"ini2toml[lite]>=0.14; extra == \"test\"",
"jaraco.develop>=7.21; (python_version >= \"3.9\" and sys_platform != \"cygwin\") and extra == \"test\"",
"jaraco.develop>=7.21; sys_platform != \"cygwin\" and extra == \"type\"",
"jaraco.envs>=2.2; extra == \"test\"",
"jaraco.packaging>=9.3; extra == \"doc\"",
"jaraco.path>=3.2.0; extra == \"test\"",
"jaraco.test; extra == \"test\"",
"jaraco.text>=3.7; extra == \"core\"",
"jaraco.tidelift>=1.4; extra == \"doc\"",
"more-itertools>=8.8; extra == \"core\"",
"mypy==1.11.*; extra == \"type\"",
"packaging>=23.2; extra == \"test\"",
"packaging>=24; extra == \"core\"",
"pip>=19.1; extra == \"test\"",
"platformdirs>=2.6.2; extra == \"core\"",
"pygments-github-lexers==0.0.5; extra == \"doc\"",
"pyproject-hooks!=1.1; extra == \"doc\"",
"pyproject-hooks!=1.1; extra == \"test\"",
"pytest!=8.1.*,>=6; extra == \"test\"",
"pytest-checkdocs>=2.4; extra == \"check\"",
"pytest-cov; extra == \"cover\"",
"pytest-enabler>=2.2; extra == \"enabler\"",
"pytest-home>=0.5; extra == \"test\"",
"pytest-mypy; extra == \"type\"",
"pytest-perf; sys_platform != \"cygwin\" and extra == \"test\"",
"pytest-ruff>=0.2.1; sys_platform != \"cygwin\" and extra == \"check\"",
"pytest-subprocess; extra == \"test\"",
"pytest-timeout; extra == \"test\"",
"pytest-xdist>=3; extra == \"test\"",
"rst.linker>=1.9; extra == \"doc\"",
"ruff>=0.5.2; sys_platform != \"cygwin\" and extra == \"check\"",
"sphinx-favicon; extra == \"doc\"",
"sphinx-inline-tabs; extra == \"doc\"",
"sphinx-lint; extra == \"doc\"",
"sphinx-notfound-page<2,>=1; extra == \"doc\"",
"sphinx-reredirects; extra == \"doc\"",
"sphinx>=3.5; extra == \"doc\"",
"sphinxcontrib-towncrier; extra == \"doc\"",
"tomli-w>=1.0.0; extra == \"test\"",
"tomli>=2.0.1; python_version < \"3.11\" and extra == \"core\"",
"towncrier<24.7; extra == \"doc\"",
"virtualenv>=13.0.0; extra == \"test\"",
"wheel>=0.43.0; extra == \"core\"",
"wheel>=0.44.0; extra == \"test\""
],
"requires_python": ">=3.7",
"version": "63.4.3"
"requires_python": ">=3.8",
"version": "74.1.2"
},
{
"artifacts": [
{
"algorithm": "sha256",
"hash": "4bdcd7d840138086126cd09254dc6195fb4fc6f01c050a1d7236f2630db1d22a",
"url": "https://files.pythonhosted.org/packages/27/d6/003e593296a85fd6ed616ed962795b2f87709c3eee2bca4f6d0fe55c6d00/wheel-0.37.1-py2.py3-none-any.whl"
"hash": "2376a90c98cc337d18623527a97c31797bd02bad0033d41547043a1cbfbe448f",
"url": "https://files.pythonhosted.org/packages/1b/d1/9babe2ccaecff775992753d8686970b1e2755d21c8a63be73aba7a4e7d77/wheel-0.44.0-py3-none-any.whl"
},
{
"algorithm": "sha256",
"hash": "e9a504e793efbca1b8e0e9cb979a249cf4a0a7b5b8c9e8b65a5e39d49529c1c4",
"url": "https://files.pythonhosted.org/packages/c0/6c/9f840c2e55b67b90745af06a540964b73589256cb10cc10057c87ac78fc2/wheel-0.37.1.tar.gz"
"hash": "a29c3f2817e95ab89aa4660681ad547c0e9547f20e75b0562fe7723c9a2a9d49",
"url": "https://files.pythonhosted.org/packages/b7/a0/95e9e962c5fd9da11c1e28aa4c0d8210ab277b1ada951d2aee336b505813/wheel-0.44.0.tar.gz"
}
],
"project_name": "wheel",
"requires_dists": [
"pytest-cov; extra == \"test\"",
"pytest>=3.0.0; extra == \"test\""
"pytest>=6.0.0; extra == \"test\"",
"setuptools>=65; extra == \"test\""
],
"requires_python": "!=3.0.*,!=3.1.*,!=3.2.*,!=3.3.*,!=3.4.*,>=2.7",
"version": "0.37.1"
"requires_python": ">=3.8",
"version": "0.44.0"
}
],
"platform_tag": null
Expand All @@ -125,8 +131,8 @@
"pip_version": "24.2",
"prefer_older_binary": false,
"requirements": [
"setuptools<64.0,>=63.1.0",
"wheel<0.38,>=0.35.1"
"setuptools>=70.0",
"wheel>=0.40"
],
"requires_python": [
"<4,>=3.8"
Expand Down
3 changes: 1 addition & 2 deletions src/python/pants/backend/python/subsystems/setuptools.py
View file
Original file line number Diff line number Diff line change
Expand Up @@ -21,8 +21,7 @@ class Setuptools(PythonToolRequirementsBase):
options_scope = "setuptools"
help_short = "Python setuptools, used to package `python_distribution` targets."

default_requirements = ["setuptools>=63.1.0,<64.0", "wheel>=0.35.1,<0.38"]

default_requirements = ["setuptools>=70.0", "wheel>=0.40"]
default_lockfile_resource = ("pants.backend.python.subsystems", "setuptools.lock")


Expand Down
6 changes: 3 additions & 3 deletions src/python/pants/core/goals/publish_test.py
View file
Original file line number Diff line number Diff line change
Expand Up @@ -135,7 +135,7 @@ def test_skipped_publish(rule_runner: RuleRunner) -> None:
)

assert result.exit_code == 0
assert "my-package-0.1.0.tar.gz skipped (requested)." in result.stderr
assert "my_package-0.1.0.tar.gz skipped (requested)." in result.stderr
assert "my_package-0.1.0-py3-none-any.whl skipped (requested)." in result.stderr


Expand Down Expand Up @@ -168,14 +168,14 @@ def test_structured_output(rule_runner: RuleRunner) -> None:
)

assert result.exit_code == 0
assert "my-package-0.1.0.tar.gz skipped (requested)." in result.stderr
assert "my_package-0.1.0.tar.gz skipped (requested)." in result.stderr
assert "my_package-0.1.0-py3-none-any.whl skipped (requested)." in result.stderr

expected = [
{
"names": [
"my-package-0.1.0.tar.gz",
"my_package-0.1.0-py3-none-any.whl",
"my_package-0.1.0.tar.gz",
],
"published": False,
"status": "skipped (requested)",
Expand Down

0 comments on commit aff4bb2

Please sign in to comment.