From 1d979d015532da2c1cf4964302745c83b2867366 Mon Sep 17 00:00:00 2001 From: KeshavSharma Date: Wed, 6 Apr 2022 13:44:08 +0530 Subject: [PATCH 1/3] pyYAML upgrade to remediate vulneriability Signed-off-by: KeshavSharma --- sdk/python/requirements-ci.txt | 2 +- sdk/python/requirements-dev.txt | 2 +- sdk/python/setup.py | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/sdk/python/requirements-ci.txt b/sdk/python/requirements-ci.txt index d6767059e44..51998c667aa 100644 --- a/sdk/python/requirements-ci.txt +++ b/sdk/python/requirements-ci.txt @@ -20,6 +20,6 @@ pytest-lazy-fixture==0.6.3 pytest-timeout==1.4.2 pytest-ordering==0.6.* pytest-mock==1.10.4 -PyYAML==5.3.1 +PyYAML==5.4.* great-expectations==0.13.2 adlfs==0.5.9 diff --git a/sdk/python/requirements-dev.txt b/sdk/python/requirements-dev.txt index c7a4ad37d91..2a6d86d8ff8 100644 --- a/sdk/python/requirements-dev.txt +++ b/sdk/python/requirements-dev.txt @@ -19,7 +19,7 @@ pytest-lazy-fixture==0.6.3 pytest-mock pytest-timeout pytest-ordering==0.6.* -PyYAML==5.1.* +PyYAML==5.4.* fastavro==0.* pyarrow Sphinx diff --git a/sdk/python/setup.py b/sdk/python/setup.py index fa0c3d900f8..522aba61610 100644 --- a/sdk/python/setup.py +++ b/sdk/python/setup.py @@ -36,7 +36,7 @@ "pandas~=1.0.0", "pandavro==1.5.*", "protobuf>=3.10", - "PyYAML==5.3.*", + "PyYAML==5.4.*", "fastavro>=0.22.11,<0.23", "tabulate==0.8.*", "toml==0.10.*", From 9295a13a8ef55547690cf76b866415d31717a012 Mon Sep 17 00:00:00 2001 From: KeshavSharma Date: Wed, 6 Apr 2022 15:19:37 +0530 Subject: [PATCH 2/3] update pipeline dependencies Signed-off-by: KeshavSharma --- .github/workflows/complete.yml | 2 +- .github/workflows/master_only.yml | 6 +++--- .github/workflows/release.yml | 4 ++-- sdk/python/requirements-ci.txt | 2 +- 4 files changed, 7 insertions(+), 7 deletions(-) diff --git a/.github/workflows/complete.yml b/.github/workflows/complete.yml index b165e86c7b8..2898cdd5de4 100644 --- a/.github/workflows/complete.yml +++ b/.github/workflows/complete.yml @@ -14,7 +14,7 @@ jobs: MAVEN_CACHE: gs://feast-templocation-kf-feast/.m2.2020-08-19.tar steps: - uses: actions/checkout@v2 - - uses: GoogleCloudPlatform/github-actions/setup-gcloud@master + - uses: GoogleCloudPlatform/github-actions/setup-gcloud@v0 with: version: '290.0.1' export_default_credentials: true diff --git a/.github/workflows/master_only.yml b/.github/workflows/master_only.yml index f1652ecc55d..8a7d22adcab 100644 --- a/.github/workflows/master_only.yml +++ b/.github/workflows/master_only.yml @@ -18,7 +18,7 @@ jobs: MAVEN_CACHE: gs://feast-templocation-kf-feast/.m2.2020-08-19.tar steps: - uses: actions/checkout@v2 - - uses: GoogleCloudPlatform/github-actions/setup-gcloud@master + - uses: GoogleCloudPlatform/github-actions/setup-gcloud@v0 with: version: '290.0.1' export_default_credentials: true @@ -47,7 +47,7 @@ jobs: PUBLISH_BUCKET: feast-jobs steps: - uses: actions/checkout@v2 - - uses: GoogleCloudPlatform/github-actions/setup-gcloud@master + - uses: GoogleCloudPlatform/github-actions/setup-gcloud@v0 with: version: '290.0.1' export_default_credentials: true @@ -90,7 +90,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - uses: actions/checkout@v2 - - uses: GoogleCloudPlatform/github-actions/setup-gcloud@master + - uses: GoogleCloudPlatform/github-actions/setup-gcloud@v0 with: version: '290.0.1' export_default_credentials: true diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 157a593d35f..0b34501c98b 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -62,7 +62,7 @@ jobs: with: username: ${{ secrets.DOCKERHUB_USERNAME }} password: ${{ secrets.DOCKERHUB_TOKEN }} - - uses: GoogleCloudPlatform/github-actions/setup-gcloud@master + - uses: GoogleCloudPlatform/github-actions/setup-gcloud@v0 with: version: '290.0.1' export_default_credentials: true @@ -104,7 +104,7 @@ jobs: HELM_VERSION: v2.17.0 steps: - uses: actions/checkout@v2 - - uses: GoogleCloudPlatform/github-actions/setup-gcloud@master + - uses: GoogleCloudPlatform/github-actions/setup-gcloud@v0 with: version: '290.0.1' export_default_credentials: true diff --git a/sdk/python/requirements-ci.txt b/sdk/python/requirements-ci.txt index 51998c667aa..8a61c2a4972 100644 --- a/sdk/python/requirements-ci.txt +++ b/sdk/python/requirements-ci.txt @@ -1,6 +1,6 @@ cryptography==3.1 flake8 -black==19.10b0 +black==22.3.0 isort>=5 grpcio-tools==1.31.0 pyspark==3.0.1 From e0098a145b8145d20c8c53015883bfcc5faf936c Mon Sep 17 00:00:00 2001 From: KeshavSharma Date: Thu, 28 Apr 2022 10:39:56 +0530 Subject: [PATCH 3/3] use 5.4 or higher version of pyyaml Signed-off-by: KeshavSharma --- sdk/python/requirements-ci.txt | 2 +- sdk/python/requirements-dev.txt | 2 +- sdk/python/setup.py | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/sdk/python/requirements-ci.txt b/sdk/python/requirements-ci.txt index 8a61c2a4972..7a6c140b34d 100644 --- a/sdk/python/requirements-ci.txt +++ b/sdk/python/requirements-ci.txt @@ -20,6 +20,6 @@ pytest-lazy-fixture==0.6.3 pytest-timeout==1.4.2 pytest-ordering==0.6.* pytest-mock==1.10.4 -PyYAML==5.4.* +PyYAML>=5.4.* great-expectations==0.13.2 adlfs==0.5.9 diff --git a/sdk/python/requirements-dev.txt b/sdk/python/requirements-dev.txt index 2a6d86d8ff8..4ea176b6990 100644 --- a/sdk/python/requirements-dev.txt +++ b/sdk/python/requirements-dev.txt @@ -19,7 +19,7 @@ pytest-lazy-fixture==0.6.3 pytest-mock pytest-timeout pytest-ordering==0.6.* -PyYAML==5.4.* +PyYAML>=5.4.* fastavro==0.* pyarrow Sphinx diff --git a/sdk/python/setup.py b/sdk/python/setup.py index 522aba61610..b21d6985d87 100644 --- a/sdk/python/setup.py +++ b/sdk/python/setup.py @@ -36,7 +36,7 @@ "pandas~=1.0.0", "pandavro==1.5.*", "protobuf>=3.10", - "PyYAML==5.4.*", + "PyYAML>=5.4.*", "fastavro>=0.22.11,<0.23", "tabulate==0.8.*", "toml==0.10.*",