Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Project dependencies may have API risk issues #112

Closed
PyDeps opened this issue Oct 26, 2022 · 0 comments
Closed

Project dependencies may have API risk issues #112

PyDeps opened this issue Oct 26, 2022 · 0 comments

Comments

@PyDeps
Copy link

PyDeps commented Oct 26, 2022

Hi, In metarget, inappropriate dependency versioning constraints can cause risks.

Below are the dependencies and version constraints that the project is using

PyYaml
docker==5.0.0
packaging
requests
beautifulsoup4
tqdm
prettytable==1.0.1

The version constraint == will introduce the risk of dependency conflicts because the scope of dependencies is too strict.
The version constraint No Upper Bound and * will introduce the risk of the missing API Error because the latest version of the dependencies may remove some APIs.

After further analysis, in this project,
The version constraint of dependency packaging can be changed to >=14.1,<=21.3.
The version constraint of dependency requests can be changed to >=0.2.1,<=0.2.3.
The version constraint of dependency requests can be changed to >=0.7.0,<=2.24.0.
The version constraint of dependency requests can be changed to ==2.26.0.
The version constraint of dependency beautifulsoup4 can be changed to >=4.10.0,<=4.11.1.
The version constraint of dependency tqdm can be changed to >=4.36.0,<=4.64.0.
The version constraint of dependency prettytable can be changed to >=0.6,<=1.0.1.

The above modification suggestions can reduce the dependency conflicts as much as possible,
and introduce the latest version as much as possible without calling Error in the projects.

The invocation of the current project includes all the following methods.

The calling methods from the packaging
packaging.version.parse
The calling methods from the requests
requests.get
The calling methods from the beautifulsoup4
bs4.BeautifulSoup
The calling methods from the tqdm
tqdm.tqdm
The calling methods from the prettytable
prettytable.PrettyTable
prettytable.PrettyTable.add_row
prettytable.PrettyTable.get_string
The calling methods from the all methods
core.env_managers.cni_plugin_installer.CNIPluginInstaller.install_cni_plugin
utils.checkers.docker_specified_installed
cls._get_kubeadm_token_and_hash
vuln.get
version.rstrip.endswith
cls._act
flask.redirect
dict.keys
fw.write
version_string.re.search.group.startswith
int
flask.render_template_string
res.stdout.decode.split.pop
flask.Flask.route
res.stdout.decode
core.env_managers.docker_installer.DockerInstaller.uninstall
os.path.join
CNIPluginInstaller._install_flannel
pathlib.Path.unlink
flask.Flask.run
print
utils.checkers.kata_specified_installed
filename.re.search.group
re.search
core.env_managers.kubernetes_installer.KubernetesInstaller.uninstall
cls._pull_image
utils.filters.filter_vuln_by_name.startswith
subprocess.run
res.stdout.decode.split
yaml.load.keys
PIL.Image.open
pathlib.Path.exists
package_name.lstrip
debug_input
re.sub
tr.a.get_text.startswith
deb.split
DockerInstaller.install_by_version
cls._pre_configure
cls._pre_install
open
res.headers.get
os.chown
cls._get_k8s_images_list
XXXInstaller.install_by_version
load_vulns
utils.filters.filter_vuln_by_name
sys.exit
operator.itemgetter
core.vuln_app_manager.resource_modifier.generate_deployments_with_modifications
cls.reload_and_restart_docker
cmds.internal.deploy_vuln_resources_in_k8s
filename.rsplit.lower
fr.read
KubernetesInstaller.uninstall
werkzeug.utils.secure_filename.rsplit
debug
mappings.items
core.env_managers.kubernetes_resource_deployer.KubernetesResourceDeployer.delete
version.rstrip.rstrip
temp_yaml.endswith
docker_installed
filter_name_by_regex
cls._install_with_context
cls.docker_client.images.get
yaml.endswith
context.get
utils.system.reboot_system
cls._pull_domestic_image
dict
os.readlink.split
entry.split.strip.sort
utils.color_print.debug_input
core.vuln_app_manager.port_manager.allocate_ports
obj_list.keys
input
yaml.dump
os.environ.get
KernelInstaller.install_by_version
core.env_managers.package_list_downloader.download_package_list
core.vuln_app_manager.vuln_loader.load_vulns_by_dir
str
utils.system.mkdir_if_not_exist
res.stdout.decode.split.startswith
version_table.find_all
core.env_managers.kata_containers_installer.KataContainersInstaller.uninstall
DockerInstaller.uninstall
utils.checkers.docker_kubernetes_installed
os.path.join.extend
show_table
bs4.BeautifulSoup
cls.docker_client.images.get.replace
cls._run_kubeadm
string.Template
pathlib.Path.mkdir
cls._modify_grub
cls.get_host_ip
glob.glob
cls._pull_images
docker.from_env
len
core.env_managers.kubernetes_installer.KubernetesInstaller.install_by_version
tqdm.tqdm
utils.checkers.containerd_specified_installed
core.env_managers.kernel_installer.KernelInstaller.install_by_version
utils.system.reload_daemon_config
services_using_ports.index
CNIPluginInstaller._install_calico
pathlib.Path
cls._pull_docker_image
KubernetesInstaller.install_by_version
load_vulns_by_dir
cls._get_kubernetes_cni_version
shutil.rmtree
cls._install_one_gadget_by_version
encode
re.match
collections.OrderedDict
yaml_path.split
split.append
_get_next_available_port
requests.get
copy.copy
KataContainersInstaller.install_by_version
copy.copy.append
utils.checkers.kernel_specified_installed
cls._install_by_version_with_apt
allowed_file
version_string.re.search.group
core.vuln_app_manager.resource_modifier.generate_svcs_with_clusterip_to_nodeport
core.vuln_cn_manager.vuln_loader.load_vulns_by_dir
XXXInstaller.uninstall
string.Template.safe_substitute
entry.get_text
PIL.Image.open.load
new_name.split
f.write
utils.color_print.warning
link_target.split.split
list.append
utils.color_print.debug
utils.checkers.gadget_in_gadgets
cls._pull_k8s_images
pathlib.Path.symlink_to
os.getcwd
ports_usage.append
werkzeug.utils.secure_filename
format.split
flask.Flask
k8s_version.re.search.group
cls._image_exist
prettytable.PrettyTable
server_string.re.search.group
flask.flash
cmds.internal.delete_vuln_resources_in_k8s
cls._pull_quay_image
config.k8s_hash_generator.format.split
entry.startswith
cls._get_apt_complete_package
yaml.load
prettytable.PrettyTable.add_row
pathlib.Path.touch
utils.color_print.error_and_exit
cls._apt_update
socket.socket.close
socket.socket.connect
core.env_managers.kata_containers_installer.KataContainersInstaller.install_by_version
depends.split
core.env_managers.docker_installer.DockerInstaller.install_by_version
cls._get_apt_complete_version
cls.download_file
tr.a.get_text
cls._is_version_available_in_apt
requests.get.iter_content
cls._get_k8s_images_list_by_version
cls._update_k8s_worker_script
utils.checkers.kubernetes_specified_installed
core.vuln_app_manager.port_manager.release_ports
load_vuln
shutil.copy
utils.checkers.docker_installed
kubernetes_installed
depend.split.split
os.getuid
dict.pop
depend.split
platform.dist
res.re.search.group
cls._fetch_package_list_by_version
services_using_ports.pop
depend.split.split.split
nl_print
cls._tag_image
utils.color_print.error
json.loads
list
repo_entry.format.split
release_ports
ports_usage.pop
cls.docker_client.images.get.tag
core.env_managers.kubernetes_resource_deployer.KubernetesResourceDeployer.apply
prettytable.PrettyTable.get_string
socket.socket.getsockname
format
f.read
os.readlink
mappings.pop
open.close
join
image_file.save
obj.values
utils.table.show_table
json.dumps
utils.verbose.verbose_output
cls._pull_domestic_images
cls._add_apt_repository
bs4.BeautifulSoup.find_all
CNIPluginInstaller._install_cilium
cls.docker_client.images.remove
os.path.split
packaging.version.parse
v.startswith
config.kata_tar_decompress_dest.format.split
gpg_url.format.split
cls._install_cni_plugin
cls._configure_docker_with_kata
action.format.split
set
download_package_list
cls._create_k8s_resources
cls._install_by_version_with_download
socket.socket
split
zip
image.format.split
get_img_size
allocate_ports
cls._config_auth
os.getgid
entry.split
f.read.strip
entry.split.strip
os.mkdir
grub_option.format.split
utils.system.create_file_if_not_exist
action.strip
ports_used_list.append
res.stdout.decode.strip
_get_gadget_version_from_gadgets
KataContainersInstaller.uninstall

@developer
Could please help me check this issue?
May I pull a request to fix it?
Thank you very much.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants