upgrade auth0-python version to ultimately resolve CVE-2024-26130

[tylergraff]

Reference Issues or PRs

Fixes #2313

What does this implement/fix?

Put a x in the boxes that apply

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds a feature)
• Breaking change (fix or feature that would cause existing features not to work as expected)
• Documentation Update
• Code style update (formatting, renaming)
• Refactoring (no functional changes, no API changes)
• Build related changes
• Other (please describe):

Testing

• Did you test the pull request locally?
• Did you add new tests?

Any other comments?

[dcmcand]

@tylergraff it looks like this creates some dependency issues for some versions of python. Can you look into that? https://github.com/nebari-dev/nebari/actions/runs/8254991236/job/22580755776?pr=2314

[viniciusdc]

Hi @tylergraff thanks for the PR, regarding the conda build there, I will add some docs later today, but here's a way to run this locally:

SRC_DIR = Path(__file__).parent.parent.parent
PYPROJECT = SRC_DIR / "pyproject.toml"

def test_build_by_conda_forge(tmp_path):
    """
    This test ensures that nebari can be built and packaged by conda-forge.
    This is achieved by walking through the following steps:
      1. Use Python build package to generate the `sdist` .tar.gz file
      2. Use grayskull package to generate the `meta.yaml` recipe file
      3. Use conda build to attempt to build the nebari package from the `meta.yaml`
    These steps mimic what takes places on the conda-forge/nebari-feedstock repo whenever
    a new version of the package gets released.
    NOTE: this test requires conda and conda-build
    """

    assert PYPROJECT.exists()

    try:
        # build sdist
        subprocess.run(
            ["python", "-m", "build", SRC_DIR, "--outdir", tmp_path],
            stdout=subprocess.PIPE,
            stderr=subprocess.PIPE,
            check=True,
        )

        # get location of sdist file built above
        sdist_loc = next(tmp_path.glob("*.tar.gz"))
        # run grayskull to create the meta.yaml using the local sdist file
        subprocess.run(
            [
                "grayskull",
                "pypi",
                "--strict-conda-forge",
                sdist_loc,
                "--output",
                tmp_path,
            ],
            stdout=subprocess.PIPE,
            stderr=subprocess.PIPE,
            check=True,
        )

        # get the directory the meta.yaml is in
        meta_loc = tmp_path / "nebari"
        # try to run conda build to build package from meta.yaml
        subprocess.run(
            ["conda", "build", "--channel=conda-forge", meta_loc],
            stdout=subprocess.PIPE,
            stderr=subprocess.PIPE,
            check=True,
        )
    except subprocess.CalledProcessError as e:
        print(e.stderr.decode("utf-8"))
        raise e

You might need to make some changes to ensure the path is correct, as this originally was part of our test suit.

[dharhas]

Question. Do we still use auth0-python? Wouldn't it be an optional dependency if you wanted to integrate with the auth0 service?

[dcmcand]

resolved by #2315