-
-
Notifications
You must be signed in to change notification settings - Fork 267
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Upgrade Python Version and Several Other Packages for Security #3303
Conversation
No Actual Changes
The types-requests==2.31.0.2 dependency was double-listed right next to each other; this commit removes one.
Alphabetize requirements.txt for developer convenience; this helps to find duplicates and unnecessarily-pinned subdependencies, as well as making the file easier to read and use.
I had forgotten we also set a second linter exclusion, for We didn't name that variable on our fork, and we didn't want to change variable names from upstream, so we added an exclusion. For this repo, I'm adding the same exclusion for now, but feel free to adjust as desired (though that's probably a separate PR). |
@mouse-reeve This is the PR I had emailed you before submitting. Is there anything else I can do to help make this easier to review and merge? I'm a little concerned that it becomes more likely to cause issues the more other things people write against the Python version this changes. |
I'll fix the conflicts with #3318 once this one is merged. |
Ah I apologize @MaggieFero that's all on me; I'm taking a look at merging now |
Hello! Our fork is now successfully running in production with significant security-relevant package upgrades, and is otherwise mostly equivalent to bookwyrm-social/main (with some small changes that are based on preference for our instance, and that I wouldn't expect to affect upgrade feasibility).
This PR proposes the same set of changes for the upstream bookwyrm-social repo, now that we're confident they're working in prod.
The upgrades include:
We also added the following new pins:
Finally, we alphabetized requirements.txt within each section and removed a duplicate types.requests dependency for developer convenience.
Note that one linter exclusion was added as a result of this Python upgrade; imghdr is deprecated in the 3.11 version of Python. It won't be removed until 3.13 and I didn't see any obvious replacement for now, so I'll file an issue for removing it (and the linter exception) but for now I've set that one instance of the rule to ignore.