Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Include setuptools in upgrade set #454

Merged
merged 3 commits into from
Dec 29, 2022
Merged

Include setuptools in upgrade set #454

merged 3 commits into from
Dec 29, 2022

Conversation

woodruffw
Copy link
Member

This looks like an oversight on our part: we should keep setuptools upgraded along with pip and wheel, since the default environment one can be pretty old.

@woodruffw
_virtual_env: ensure setuptools is up-to-date
a7bf4c4 
Signed-off-by: William Woodruff <william@trailofbits.com>
@woodruffw
_virtual_env: add TODO
b528849 
Signed-off-by: William Woodruff <william@trailofbits.com>
@woodruffw woodruffw added bug Something isn't working component:dep-sources Dependency sources labels Dec 28, 2022
@woodruffw woodruffw self-assigned this Dec 28, 2022
@woodruffw
Copy link
Member Author

(This is currently responsible for a bunch of spurious gh-action-pip-audit failures -- plenty of environments have a slightly older setuptools that is "vulnerable" to a ReDoS.)

@woodruffw
CHANGELOG: record changes
89fc832 
Signed-off-by: William Woodruff <william@trailofbits.com>
@woodruffw woodruffw mentioned this pull request Dec 28, 2022
Merged
tetsuo-cpp
tetsuo-cpp approved these changes Dec 29, 2022
View reviewed changes
Copy link
Contributor

@tetsuo-cpp tetsuo-cpp left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

@tetsuo-cpp tetsuo-cpp merged commit 73855b1 into main Dec 29, 2022
@tetsuo-cpp tetsuo-cpp deleted the ww/venv-upgrade-setuptools branch December 29, 2022 00:44
@tetsuo-cpp tetsuo-cpp mentioned this pull request Dec 29, 2022
Closed
@tserg tserg mentioned this pull request Jan 5, 2023
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@tetsuo-cpp tetsuo-cpp tetsuo-cpp approved these changes

@di di Awaiting requested review from di

Assignees

@woodruffw woodruffw

Labels
bug Something isn't working component:dep-sources Dependency sources
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@woodruffw @tetsuo-cpp