added pip-audit to poetry to avoid inconsistent environments

Signed-off-by: Jürgen Eckel <juergen@riddleandcode.com>
2025-03-30 15:08:31 +00:00 · 2023-06-14 09:25:38 +02:00 · 2023-06-14 09:25:38 +02:00 · 1aaec8980d
commit 1aaec8980d
parent 7139fa8e46
4 changed files with 174 additions and 11 deletions
--- a/.github/workflows/CI.yml
+++ b/.github/workflows/CI.yml
@ -43,9 +43,6 @@ jobs:
        with:
          python-version: 3.9

-      - name: Install pip-audit
-        run: pip install --upgrade pip pip-audit 
-
      - name: Setup poetry
        uses: Gr1N/setup-poetry@v8

--- a/.github/workflows/audit.yml
+++ b/.github/workflows/audit.yml
@ -21,9 +21,6 @@ jobs:
        with:
          python-version: 3.9

-      - name: Install pip-audit
-        run: pip install --upgrade pip
-
      - name: Setup poetry
        uses: Gr1N/setup-poetry@v8

--- a/poetry.lock
+++ b/poetry.lock
@ -403,6 +403,28 @@ webencodings = "*"
 [package.extras]
 css = ["tinycss2 (>=1.1.0,<1.2)"]

+[[package]]
+name = "cachecontrol"
+version = "0.13.1"
+description = "httplib2 caching for requests"
+category = "dev"
+optional = false
+python-versions = ">=3.7"
+files = [
+    {file = "cachecontrol-0.13.1-py3-none-any.whl", hash = "sha256:95dedbec849f46dda3137866dc28b9d133fc9af55f5b805ab1291833e4457aa4"},
+    {file = "cachecontrol-0.13.1.tar.gz", hash = "sha256:f012366b79d2243a6118309ce73151bf52a38d4a5dac8ea57f09bd29087e506b"},
+]
+
+[package.dependencies]
+filelock = {version = ">=3.8.0", optional = true, markers = "extra == \"filecache\""}
+msgpack = ">=0.5.2"
+requests = ">=2.16.0"
+
+[package.extras]
+dev = ["CacheControl[filecache,redis]", "black", "build", "cherrypy", "mypy", "pytest", "pytest-cov", "sphinx", "tox", "types-redis", "types-requests"]
+filecache = ["filelock (>=3.8.0)"]
+redis = ["redis (>=2.10.5)"]
+
 [[package]]
 name = "cbor"
 version = "1.0.0"
@ -717,6 +739,24 @@ ssh = ["bcrypt (>=3.1.5)"]
 test = ["pretend", "pytest (>=6.2.0)", "pytest-benchmark", "pytest-cov", "pytest-xdist"]
 test-randomorder = ["pytest-randomly"]

+[[package]]
+name = "cyclonedx-python-lib"
+version = "2.7.1"
+description = "A library for producing CycloneDX SBOM (Software Bill of Materials) files."
+category = "dev"
+optional = false
+python-versions = ">=3.6,<4.0"
+files = [
+    {file = "cyclonedx-python-lib-2.7.1.tar.gz", hash = "sha256:493bf2f30e26c48f305f745ed8580ce10d05a8d68d62a598fe95f05a0d9007dc"},
+    {file = "cyclonedx_python_lib-2.7.1-py3-none-any.whl", hash = "sha256:fabc4c8baf722faeea01c3bbca83730e3489dfb37d85c6036baa67a9a7519d40"},
+]
+
+[package.dependencies]
+packageurl-python = ">=0.9"
+setuptools = ">=47.0.0"
+sortedcontainers = ">=2.4.0,<3.0.0"
+toml = ">=0.10.0,<0.11.0"
+
 [[package]]
 name = "decorator"
 version = "5.1.1"
@ -979,6 +1019,28 @@ gevent = ["gevent (>=1.4.0)"]
 setproctitle = ["setproctitle"]
 tornado = ["tornado (>=0.2)"]

+[[package]]
+name = "html5lib"
+version = "1.1"
+description = "HTML parser based on the WHATWG HTML specification"
+category = "dev"
+optional = false
+python-versions = ">=2.7, !=3.0.*, !=3.1.*, !=3.2.*, !=3.3.*, !=3.4.*"
+files = [
+    {file = "html5lib-1.1-py2.py3-none-any.whl", hash = "sha256:0d78f8fde1c230e99fe37986a60526d7049ed4bf8a9fadbad5f00e22e58e041d"},
+    {file = "html5lib-1.1.tar.gz", hash = "sha256:b2e5b40261e20f354d198eae92afc10d750afb487ed5e50f9c4eaf07c184146f"},
+]
+
+[package.dependencies]
+six = ">=1.9"
+webencodings = "*"
+
+[package.extras]
+all = ["chardet (>=2.2)", "genshi", "lxml"]
+chardet = ["chardet (>=2.2)"]
+genshi = ["genshi"]
+lxml = ["lxml"]
+
 [[package]]
 name = "hypothesis"
 version = "6.78.2"
@ -1671,6 +1733,23 @@ files = [
 [package.dependencies]
 setuptools = "*"

+[[package]]
+name = "packageurl-python"
+version = "0.11.1"
+description = "A purl aka. Package URL parser and builder"
+category = "dev"
+optional = false
+python-versions = ">=3.7"
+files = [
+    {file = "packageurl-python-0.11.1.tar.gz", hash = "sha256:bbcc53d2cb5920c815c1626c75992f319bfc450b73893fa7bd8aac5869aa49fe"},
+    {file = "packageurl_python-0.11.1-py3-none-any.whl", hash = "sha256:4bad1d3ea4feb5e7a1db5ca8fb690ac9c82ab18e08d500755947b853df68817d"},
+]
+
+[package.extras]
+build = ["wheel"]
+lint = ["black", "isort", "mypy"]
+test = ["pytest"]
+
 [[package]]
 name = "packaging"
 version = "23.1"
@ -1750,6 +1829,83 @@ files = [
    {file = "pickleshare-0.7.5.tar.gz", hash = "sha256:87683d47965c1da65cdacaf31c8441d12b8044cdec9aca500cd78fc2c683afca"},
 ]

+[[package]]
+name = "pip"
+version = "23.1.2"
+description = "The PyPA recommended tool for installing Python packages."
+category = "dev"
+optional = false
+python-versions = ">=3.7"
+files = [
+    {file = "pip-23.1.2-py3-none-any.whl", hash = "sha256:3ef6ac33239e4027d9a5598a381b9d30880a1477e50039db2eac6e8a8f6d1b18"},
+    {file = "pip-23.1.2.tar.gz", hash = "sha256:0e7c86f486935893c708287b30bd050a36ac827ec7fe5e43fe7cb198dd835fba"},
+]
+
+[[package]]
+name = "pip-api"
+version = "0.0.30"
+description = "An unofficial, importable pip API"
+category = "dev"
+optional = false
+python-versions = ">=3.7"
+files = [
+    {file = "pip-api-0.0.30.tar.gz", hash = "sha256:a05df2c7aa9b7157374bcf4273544201a0c7bae60a9c65bcf84f3959ef3896f3"},
+    {file = "pip_api-0.0.30-py3-none-any.whl", hash = "sha256:2a0314bd31522eb9ffe8a99668b0d07fee34ebc537931e7b6483001dbedcbdc9"},
+]
+
+[package.dependencies]
+pip = "*"
+
+[[package]]
+name = "pip-audit"
+version = "2.5.6"
+description = "A tool for scanning Python environments for known vulnerabilities"
+category = "dev"
+optional = false
+python-versions = ">=3.7"
+files = [
+    {file = "pip_audit-2.5.6-py3-none-any.whl", hash = "sha256:7673bea690470024f1aec9be26055334cb987a530c6a431a31c347f66064e475"},
+    {file = "pip_audit-2.5.6.tar.gz", hash = "sha256:04fc0ad1727674181bda243a457af5a73038ee691dd9b8afc71f7e9292ce3912"},
+]
+
+[package.dependencies]
+CacheControl = {version = ">=0.12.0", extras = ["filecache"]}
+cyclonedx-python-lib = ">=2.0,<2.5.0 || >2.5.0,<3.0"
+html5lib = ">=1.1"
+packaging = ">=23.0.0"
+pip-api = ">=0.0.28"
+pip-requirements-parser = ">=32.0.0"
+requests = ">=2.31.0"
+rich = ">=12.4"
+toml = ">=0.10"
+urllib3 = ">=1.26,<2.0"
+
+[package.extras]
+dev = ["build", "bump (>=1.3.2)", "pip-audit[doc,lint,test]"]
+doc = ["pdoc"]
+lint = ["black (>=22.3.0)", "interrogate", "isort", "mypy", "ruff (<0.0.270)", "types-html5lib", "types-requests", "types-toml"]
+test = ["coverage[toml]", "pretend", "pytest", "pytest-cov"]
+
+[[package]]
+name = "pip-requirements-parser"
+version = "32.0.1"
+description = "pip requirements parser - a mostly correct pip requirements parsing library because it uses pip's own code."
+category = "dev"
+optional = false
+python-versions = ">=3.6.0"
+files = [
+    {file = "pip-requirements-parser-32.0.1.tar.gz", hash = "sha256:b4fa3a7a0be38243123cf9d1f3518da10c51bdb165a2b2985566247f9155a7d3"},
+    {file = "pip_requirements_parser-32.0.1-py3-none-any.whl", hash = "sha256:4659bc2a667783e7a15d190f6fccf8b2486685b6dba4c19c3876314769c57526"},
+]
+
+[package.dependencies]
+packaging = "*"
+pyparsing = "*"
+
+[package.extras]
+docs = ["Sphinx (>=3.3.1)", "doc8 (>=0.8.1)", "sphinx-rtd-theme (>=0.5.0)"]
+testing = ["aboutcode-toolkit (>=6.0.0)", "black", "pytest (>=6,!=7.0.0)", "pytest-xdist (>=2)"]
+
 [[package]]
 name = "pkginfo"
 version = "1.9.6"
@ -1875,20 +2031,20 @@ sha3 = ["pysha3"]

 [[package]]
 name = "planetmint-transactions"
-version = "0.8.1"
+version = "0.8.2"
 description = "Python implementation of the planetmint transactions spec"
 category = "main"
 optional = false
 python-versions = ">=3.9,<4.0"
 files = [
-    {file = "planetmint_transactions-0.8.1-py3-none-any.whl", hash = "sha256:25a9d310085b088de1688ca269f2130d455af9c6470cd67f587ba8e6a95bd0f6"},
-    {file = "planetmint_transactions-0.8.1.tar.gz", hash = "sha256:f9c473312731dd0e79445074ce7c23d8a2e7c7a29a82ce15b8efd87a2303f33f"},
+    {file = "planetmint_transactions-0.8.2-py3-none-any.whl", hash = "sha256:56fb452cbb327f4466397aeb0f7a79c97be676222a93f7e7d203c3e94bbc5e27"},
+    {file = "planetmint_transactions-0.8.2.tar.gz", hash = "sha256:7d5a2f6a0e075db329809b6744fbf1894f2cc46866d67067b5022eb556996cbb"},
 ]

 [package.dependencies]
 base58 = ">=2.1.1,<3.0.0"
 jsonschema = ">=4.16.0,<5.0.0"
-planetmint-cryptoconditions = ">=1.2.0,<2.0.0"
+planetmint-cryptoconditions = ">=1.2.2,<2.0.0"
 planetmint-ipld = ">=0.0.3,<0.0.4"
 planetmint-py-cid = ">=0.4.2,<0.5.0"
 python-rapidjson = ">=1.8,<2.0"
@ -3056,6 +3212,18 @@ files = [
 msgpack = "*"
 pytz = "*"

+[[package]]
+name = "toml"
+version = "0.10.2"
+description = "Python Library for Tom's Obvious, Minimal Language"
+category = "dev"
+optional = false
+python-versions = ">=2.6, !=3.0.*, !=3.1.*, !=3.2.*"
+files = [
+    {file = "toml-0.10.2-py2.py3-none-any.whl", hash = "sha256:806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b"},
+    {file = "toml-0.10.2.tar.gz", hash = "sha256:b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f"},
+]
+
 [[package]]
 name = "tomli"
 version = "2.0.1"
@ -3400,4 +3568,4 @@ testing = ["func-timeout", "jaraco.itertools", "pytest (>=6)", "pytest-black (>=
 [metadata]
 lock-version = "2.0"
 python-versions = "^3.9"
-content-hash = "bcd8049e8e3ab7d29de82e32689ad38a84c9f3b9dbc0b2871d2a53f298dfeaa1"
+content-hash = "98c4577730a35fdda7b853c1921860cd298abcead332e443fed8497544022429"
--- a/pyproject.toml
+++ b/pyproject.toml
@ -107,6 +107,7 @@ pytest-xdist = "^3.1.0"
 pytest-flask = "^1.2.0"
 pytest-aiohttp = "^1.0.4"
 pytest-asyncio = "^0.20.3"
+pip-audit = "^2.5.6"

 [build-system]
 requires = ["poetry-core"]