Dependencies update patch #223
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
oleg-jukovec
approved these changes
Jul 19, 2022
DifferentialOrange
force-pushed
the
DifferentialOrange/update-deps
branch
2 times, most recently
from
5ec2dde to
0d74706
Compare
Tests with Tarantool EE runs only with latest msgpack, so "msgpack-deps" variable and Actions steps for it are not used.
DifferentialOrange
force-pushed
the
DifferentialOrange/update-deps
branch
from
0d74706 to
2ebb65e
Compare
In this patch we bump msgpack requirement since version 1.0.4 has various vulnerability fixes (for example, [1]). Since the code is still compatible with msgpack-python and older msgpack, tests are not removed in this patch. 1. msgpack/msgpack-python#153
In this patch we bump PyYAML requirement since version 6.0 has various vulnerability fixes (see [1-3]). Since PyYAML is used only in tests, the only reason of this patch is to remove Dependabot alerts. After migrating to GitHub Actions issue [4] is no longer relevant, so we are not restricted to using 5.2b1 version. There is no PyYAML 6.0 for Python 3.5 since it reached the end of its life on September 13th, 2020. So this patch removed Python 3.5 pipeline as well. 1. https://github.com/tarantool/tarantool-python/security/dependabot/1 2. https://github.com/tarantool/tarantool-python/security/dependabot/2 3. https://github.com/tarantool/tarantool-python/security/dependabot/3 4. 4f79627
DifferentialOrange
force-pushed
the
DifferentialOrange/update-deps
branch
3 times, most recently
from
56e978f to
cbbd7e5
Compare
After update [1] and Tarantool 2.10 release it is possible to install it with setup-tarantool tools. This patch uses setup-tarantool to install release Tarantool 2.10 instead of pre-release one. 1. tarantool/setup-tarantool@6c88e71
DifferentialOrange
force-pushed
the
DifferentialOrange/update-deps
branch
from
00e2922 to
f2e2baa
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
ci: remove unused msgpack variable in EE test
Tests with Tarantool EE runs only with latest msgpack, so "msgpack-deps" variable and Actions steps for it are not used.
deps: bump msgpack requirement to 1.0.4
In this patch we bump msgpack requirement since version 1.0.4 has various vulnerability fixes (for example, [1]). Since the code is still compatible with msgpack-python and older msgpack, tests are not removed in this patch.
deps: bump test PyYAML requirement to 6.0
In this patch we bump PyYAML requirement since version 6.0 has various vulnerability fixes (see [1-3]). Since PyYAML is used only in tests, the only reason of this patch is to remove Dependabot alerts. After migrating to GitHub Actions issue [4] is no longer relevant, so we are not restricted to using 5.2b1 version. There is no PyYAML 6.0 for Python 3.5 since it reached the end of its life on September 13th, 2020. So this patch removed Python 3.5 pipeline as well.
ci: install Tarantool 2.10 with GitHub Actions
After update [1] and Tarantool 2.10 release it is possible to install it with setup-tarantool tools. This patch uses setup-tarantool to install release Tarantool 2.10 instead of pre-release one.