Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Upgrade setuptools to fix CVE #21314

Merged
merged 4 commits into from
Sep 13, 2024
Merged

Upgrade setuptools to fix CVE #21314

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
d2f9d42
Upgrade setuptools version to fix CVE
krishnan-chandra Sep 12, 2024
606cae0
Update setuptools lockfile
krishnan-chandra Sep 12, 2024
9ccb714
Fix publish test
krishnan-chandra Sep 12, 2024
a1c2d95
Update 2.24.x release notes
krishnan-chandra Sep 12, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions docs/notes/2.24.x.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,6 +30,8 @@ The default lockfiles bundled with Pants for various tools (ex: to run `black`)

As a consequence of the lockfile generation, newer versions of many tools are now included in the default lockfiles.

The versions of `setuptools` and `wheel` used in Pants have been upgraded to `74.1.2` and `0.44.0` to address a remote code execution vulnerability in versions before setuptools `70.0`. This forces the minimum Python version to 3.8, in line with the changes mentioned above.


#### Shell

Expand Down
130 changes: 68 additions & 62 deletions src/python/pants/backend/python/subsystems/setuptools.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,8 +9,8 @@
// "CPython<4,>=3.8"
// ],
// "generated_with_requirements": [
// "setuptools<64.0,>=63.1.0",
// "wheel<0.38,>=0.35.1"
// "setuptools>=70.0",
// "wheel>=0.40"
// ],
// "manylinux": "manylinux2014",
// "requirement_constraints": [],
Expand All @@ -33,85 +33,91 @@
"artifacts": [
{
"algorithm": "sha256",
"hash": "7f61f7e82647f77d4118eeaf43d64cbcd4d87e38af9611694d4866eb070cd10d",
"url": "https://files.pythonhosted.org/packages/2a/a3/49c29680d6118273b992b40ebe881e8e899b8e26a4e951f37f223da8f862/setuptools-63.4.3-py3-none-any.whl"
"hash": "5f4c08aa4d3ebcb57a50c33b1b07e94315d7fc7230f7115e47fc99776c8ce308",
"url": "https://files.pythonhosted.org/packages/cb/9c/9ad11ac06b97e55ada655f8a6bea9d1d3f06e120b178cd578d80e558191d/setuptools-74.1.2-py3-none-any.whl"
},
{
"algorithm": "sha256",
"hash": "521c833d1e5e1ef0869940e7f486a83de7773b9f029010ad0c2fe35453a9dad9",
"url": "https://files.pythonhosted.org/packages/5b/ff/69fd395c5237da934753752b71c38e95e137bd0603d5640df70ddaea8038/setuptools-63.4.3.tar.gz"
"hash": "95b40ed940a1c67eb70fc099094bd6e99c6ee7c23aa2306f4d2697ba7916f9c6",
"url": "https://files.pythonhosted.org/packages/3e/2c/f0a538a2f91ce633a78daaeb34cbfb93a54bd2132a6de1f6cec028eee6ef/setuptools-74.1.2.tar.gz"
}
],
"project_name": "setuptools",
"requires_dists": [
"build[virtualenv]; extra == \"testing\"",
"build[virtualenv]; extra == \"testing-integration\"",
"filelock>=3.4.0; extra == \"testing\"",
"filelock>=3.4.0; extra == \"testing-integration\"",
"flake8-2020; extra == \"testing\"",
"flake8<5; extra == \"testing\"",
"furo; extra == \"docs\"",
"ini2toml[lite]>=0.9; extra == \"testing\"",
"jaraco.envs>=2.2; extra == \"testing\"",
"jaraco.envs>=2.2; extra == \"testing-integration\"",
"jaraco.packaging>=9; extra == \"docs\"",
"jaraco.path>=3.2.0; extra == \"testing\"",
"jaraco.path>=3.2.0; extra == \"testing-integration\"",
"jaraco.tidelift>=1.4; extra == \"docs\"",
"mock; extra == \"testing\"",
"pip-run>=8.8; extra == \"testing\"",
"pip>=19.1; extra == \"testing\"",
"pygments-github-lexers==0.0.5; extra == \"docs\"",
"pytest-black>=0.3.7; platform_python_implementation != \"PyPy\" and extra == \"testing\"",
"pytest-checkdocs>=2.4; extra == \"testing\"",
"pytest-cov; platform_python_implementation != \"PyPy\" and extra == \"testing\"",
"pytest-enabler; extra == \"testing-integration\"",
"pytest-enabler>=1.3; extra == \"testing\"",
"pytest-flake8; extra == \"testing\"",
"pytest-mypy>=0.9.1; platform_python_implementation != \"PyPy\" and extra == \"testing\"",
"pytest-perf; extra == \"testing\"",
"pytest-xdist; extra == \"testing\"",
"pytest-xdist; extra == \"testing-integration\"",
"pytest; extra == \"testing-integration\"",
"pytest>=6; extra == \"testing\"",
"rst.linker>=1.9; extra == \"docs\"",
"sphinx-favicon; extra == \"docs\"",
"sphinx-hoverxref<2; extra == \"docs\"",
"sphinx-inline-tabs; extra == \"docs\"",
"sphinx-notfound-page==0.8.3; extra == \"docs\"",
"sphinx-reredirects; extra == \"docs\"",
"sphinx; extra == \"docs\"",
"sphinxcontrib-towncrier; extra == \"docs\"",
"tomli-w>=1.0.0; extra == \"testing\"",
"tomli; extra == \"testing-integration\"",
"virtualenv>=13.0.0; extra == \"testing\"",
"virtualenv>=13.0.0; extra == \"testing-integration\"",
"wheel; extra == \"testing\"",
"wheel; extra == \"testing-integration\""
"build[virtualenv]>=1.0.3; extra == \"test\"",
"filelock>=3.4.0; extra == \"test\"",
"furo; extra == \"doc\"",
"importlib-metadata>=6; python_version < \"3.10\" and extra == \"core\"",
"importlib-metadata>=7.0.2; python_version < \"3.10\" and extra == \"type\"",
"importlib-resources>=5.10.2; python_version < \"3.9\" and extra == \"core\"",
"ini2toml[lite]>=0.14; extra == \"test\"",
"jaraco.develop>=7.21; (python_version >= \"3.9\" and sys_platform != \"cygwin\") and extra == \"test\"",
"jaraco.develop>=7.21; sys_platform != \"cygwin\" and extra == \"type\"",
"jaraco.envs>=2.2; extra == \"test\"",
"jaraco.packaging>=9.3; extra == \"doc\"",
"jaraco.path>=3.2.0; extra == \"test\"",
"jaraco.test; extra == \"test\"",
"jaraco.text>=3.7; extra == \"core\"",
"jaraco.tidelift>=1.4; extra == \"doc\"",
"more-itertools>=8.8; extra == \"core\"",
"mypy==1.11.*; extra == \"type\"",
"packaging>=23.2; extra == \"test\"",
"packaging>=24; extra == \"core\"",
"pip>=19.1; extra == \"test\"",
"platformdirs>=2.6.2; extra == \"core\"",
"pygments-github-lexers==0.0.5; extra == \"doc\"",
"pyproject-hooks!=1.1; extra == \"doc\"",
"pyproject-hooks!=1.1; extra == \"test\"",
"pytest!=8.1.*,>=6; extra == \"test\"",
"pytest-checkdocs>=2.4; extra == \"check\"",
"pytest-cov; extra == \"cover\"",
"pytest-enabler>=2.2; extra == \"enabler\"",
"pytest-home>=0.5; extra == \"test\"",
"pytest-mypy; extra == \"type\"",
"pytest-perf; sys_platform != \"cygwin\" and extra == \"test\"",
"pytest-ruff>=0.2.1; sys_platform != \"cygwin\" and extra == \"check\"",
"pytest-subprocess; extra == \"test\"",
"pytest-timeout; extra == \"test\"",
"pytest-xdist>=3; extra == \"test\"",
"rst.linker>=1.9; extra == \"doc\"",
"ruff>=0.5.2; sys_platform != \"cygwin\" and extra == \"check\"",
"sphinx-favicon; extra == \"doc\"",
"sphinx-inline-tabs; extra == \"doc\"",
"sphinx-lint; extra == \"doc\"",
"sphinx-notfound-page<2,>=1; extra == \"doc\"",
"sphinx-reredirects; extra == \"doc\"",
"sphinx>=3.5; extra == \"doc\"",
"sphinxcontrib-towncrier; extra == \"doc\"",
"tomli-w>=1.0.0; extra == \"test\"",
"tomli>=2.0.1; python_version < \"3.11\" and extra == \"core\"",
"towncrier<24.7; extra == \"doc\"",
"virtualenv>=13.0.0; extra == \"test\"",
"wheel>=0.43.0; extra == \"core\"",
"wheel>=0.44.0; extra == \"test\""
],
"requires_python": ">=3.7",
"version": "63.4.3"
"requires_python": ">=3.8",
"version": "74.1.2"
},
{
"artifacts": [
{
"algorithm": "sha256",
"hash": "4bdcd7d840138086126cd09254dc6195fb4fc6f01c050a1d7236f2630db1d22a",
"url": "https://files.pythonhosted.org/packages/27/d6/003e593296a85fd6ed616ed962795b2f87709c3eee2bca4f6d0fe55c6d00/wheel-0.37.1-py2.py3-none-any.whl"
"hash": "2376a90c98cc337d18623527a97c31797bd02bad0033d41547043a1cbfbe448f",
"url": "https://files.pythonhosted.org/packages/1b/d1/9babe2ccaecff775992753d8686970b1e2755d21c8a63be73aba7a4e7d77/wheel-0.44.0-py3-none-any.whl"
},
{
"algorithm": "sha256",
"hash": "e9a504e793efbca1b8e0e9cb979a249cf4a0a7b5b8c9e8b65a5e39d49529c1c4",
"url": "https://files.pythonhosted.org/packages/c0/6c/9f840c2e55b67b90745af06a540964b73589256cb10cc10057c87ac78fc2/wheel-0.37.1.tar.gz"
"hash": "a29c3f2817e95ab89aa4660681ad547c0e9547f20e75b0562fe7723c9a2a9d49",
"url": "https://files.pythonhosted.org/packages/b7/a0/95e9e962c5fd9da11c1e28aa4c0d8210ab277b1ada951d2aee336b505813/wheel-0.44.0.tar.gz"
}
],
"project_name": "wheel",
"requires_dists": [
"pytest-cov; extra == \"test\"",
"pytest>=3.0.0; extra == \"test\""
"pytest>=6.0.0; extra == \"test\"",
"setuptools>=65; extra == \"test\""
],
"requires_python": "!=3.0.*,!=3.1.*,!=3.2.*,!=3.3.*,!=3.4.*,>=2.7",
"version": "0.37.1"
"requires_python": ">=3.8",
"version": "0.44.0"
}
],
"platform_tag": null
Expand All @@ -125,8 +131,8 @@
"pip_version": "24.2",
"prefer_older_binary": false,
"requirements": [
"setuptools<64.0,>=63.1.0",
"wheel<0.38,>=0.35.1"
"setuptools>=70.0",
"wheel>=0.40"
],
"requires_python": [
"<4,>=3.8"
Expand Down
3 changes: 1 addition & 2 deletions src/python/pants/backend/python/subsystems/setuptools.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,8 +21,7 @@ class Setuptools(PythonToolRequirementsBase):
options_scope = "setuptools"
help_short = "Python setuptools, used to package `python_distribution` targets."

default_requirements = ["setuptools>=63.1.0,<64.0", "wheel>=0.35.1,<0.38"]

default_requirements = ["setuptools>=70.0", "wheel>=0.40"]
default_lockfile_resource = ("pants.backend.python.subsystems", "setuptools.lock")


Expand Down
6 changes: 3 additions & 3 deletions src/python/pants/core/goals/publish_test.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -135,7 +135,7 @@ def test_skipped_publish(rule_runner: RuleRunner) -> None:
)

assert result.exit_code == 0
assert "my-package-0.1.0.tar.gz skipped (requested)." in result.stderr
assert "my_package-0.1.0.tar.gz skipped (requested)." in result.stderr
assert "my_package-0.1.0-py3-none-any.whl skipped (requested)." in result.stderr


Expand Down Expand Up @@ -168,14 +168,14 @@ def test_structured_output(rule_runner: RuleRunner) -> None:
)

assert result.exit_code == 0
assert "my-package-0.1.0.tar.gz skipped (requested)." in result.stderr
assert "my_package-0.1.0.tar.gz skipped (requested)." in result.stderr
assert "my_package-0.1.0-py3-none-any.whl skipped (requested)." in result.stderr

expected = [
{
"names": [
"my-package-0.1.0.tar.gz",
"my_package-0.1.0-py3-none-any.whl",
"my_package-0.1.0.tar.gz",
],
"published": False,
"status": "skipped (requested)",
Expand Down
Loading