Skip to content

build: improve security around package updating#110

Merged
stevenhsd merged 1 commit into
release_v09from
build/gr-desd-70-improve_security_around_package_updating
Jun 5, 2026
Merged

build: improve security around package updating#110
stevenhsd merged 1 commit into
release_v09from
build/gr-desd-70-improve_security_around_package_updating

Conversation

@georgeRobertson
Copy link
Copy Markdown
Contributor

TLDR of changes

  • Updated poetry to v2.4 to allow usage of https://python-poetry.org/docs/configuration#solvermin-release-age which prevents newly released packages from being updated until they're at least 10 days old.
  • Locked the boto3 and botocore package

What kind of changes does this PR introduce?

Tick all that apply

  • fix: A bug fix. Correlates with PATCH in SemVer
  • feat: A new feature. Correlates with MINOR in SemVer
  • docs: Documentation only changes
  • style: Changes that do not affect the meaning of the code (white-space, formatting, missing semi-colons, etc)
  • refactor: A code change that neither fixes a bug nor adds a feature
  • perf: A code change that improves performance
  • test: Adding missing or correcting existing tests
  • build: Changes that affect the build system or external dependencies (example scopes: pip, docker, npm)
  • ci: Changes to CI configuration files and scripts (example scopes: GitLabCI)

Please check if the PR fulfills these requirements

  • I have read and followed the Contributing guidance
  • Docs have been added / updated
  • Tests and Linting in the CI are passing
  • Changes have been reviewed and approved by a Project Maintainer

…ependencies

added `min-release-age` argument to poetry.toml to ensure dependencies are at least 10 days old before upgrading. This was made available in poetry v2.4
@sonarqubecloud
Copy link
Copy Markdown

Quality Gate Failed Quality Gate failed

Failed conditions
E Reliability Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

@georgeRobertson georgeRobertson changed the base branch from release_v08 to release_v09 May 28, 2026 15:15
@stevenhsd stevenhsd merged commit d27fb21 into release_v09 Jun 5, 2026
3 of 4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants