Skip to content

[core] Fix cryptography and setuptools Dependabot alerts - #4392

Merged
Harshg999 merged 2 commits into
masterfrom
fix/dependabot-cryptography-setuptools
Oct 30, 2026
Merged

[core] Fix cryptography and setuptools Dependabot alerts#4392
Harshg999 merged 2 commits into
masterfrom
fix/dependabot-cryptography-setuptools

Conversation

@Harshg999

@Harshg999 Harshg999 commented Oct 29, 2026

Copy link
Copy Markdown
Collaborator

Fixes the new Dependabot alerts for cryptography and setuptools.

Commits

  1. Upgrade setuptools to 84.1.0 and stop using pkg_resources
    • setuptools 82 removed pkg_resources, so appmanager, supervisor, settings and gunicorn_server_utils now use importlib.metadata.
    • pyformance 0.3.2 is vendored without its unguarded pkg_resources.declare_namespace() call.
    • A fallback finds SQLAlchemy 1.3 third-party dialects (trino, phoenix) through importlib.metadata.
    • The cx-Oracle build constraint setuptools<82 is now passed only as PIP_BUILD_CONSTRAINT, so it does not conflict with the 84.1.0 pin.
    • Touched files are made ruff clean, including a Python 2 file() call.
  2. Upgrade cryptography to 50.0.2 and pyOpenSSL to 26.4.0
    • pyOpenSSL 26.4.0 no longer has X509Req, load_certificate_request or crypto.verify(), which the vendored pysaml2 certificate code used. The request, signing and verify code now uses cryptography.
    • New libsaml/cert_tests.py (8 of its 11 tests fail without the change).

Testing

  • Full suite
  • Server boots on setuptools 84 without pkg_resources, and the smoke test passes.
  • ruff is clean on every changed Python file.

@Harshg999
[core] Upgrade setuptools to 84.1.0 and stop using pkg_resources
4a60b09 
setuptools 80.9.0 is affected by a MANIFEST.in exclusion bypass (fixed in
83.0.0) and a Windows path escape during legacy wheel installation
(fixed in 84.1.0). setuptools 82 removed pkg_resources, so Hue and the
packages it installs have to stop importing it.

- appmanager, supervisor, settings and gunicorn_server_utils read entry
  points and the desktop version through importlib.metadata.
- pyformance 0.3.2 calls pkg_resources.declare_namespace() without a
  guard in its __init__.py. Vendor it under ext-py3 without that line
  (it is not a namespace package) and install it as a local requirement.
- SQLAlchemy 1.3 finds third party dialects (trino://, phoenix://) only
  through pkg_resources. Wrap the dialect registry so that those
  dialects are looked up through the same "sqlalchemy.dialects" entry
  points with importlib.metadata, after the built in dialects. Add
  tests.
- The Makefile passed the cx-Oracle build constraint setuptools<82 as
  PIP_CONSTRAINT, which also constrains the setuptools the virtual env
  installs and would conflict with 84.1.0. Pass it only as
  PIP_BUILD_CONSTRAINT, which applies to pip's isolated build
  environments, where cx-Oracle's setup.py still needs pkg_resources.
- appmanager.get_bootstrap_file used the Python 2 file() builtin.

The files touched here are also made ruff clean, as CI requires, which
removes some unused imports, bindings and test variables.
@Harshg999
[core] Upgrade cryptography to 50.0.2 and pyOpenSSL to 26.4.0
78656ce 
cryptography 46.0.7 is affected by four advisories (a Bleichenbacher
oracle in PKCS#7 EnvelopedData decryption, exponential path building
with duplicate self-signed intermediates, wildcard DNS names escaping
permittedSubtrees, and a vulnerable OpenSSL in the wheels). The fixes
are in 48.0.1, 49.0.0 and 50.0.0.

pyOpenSSL was held at 26.0.0 because it caps cryptography below 47.
26.3.0 is the first release that accepts cryptography 49 and 50, so
move to 26.4.0. It no longer has X509Req, load_certificate_request or
crypto.verify(), which the vendored pysaml2 certificate code used:

- OpenSSLWrapper.create_certificate(request=True), which the SAML
  signing code calls by default, failed with an AttributeError. Build
  the certificate signing request with cryptography.
- create_cert_signed_certificate loaded the request with pyOpenSSL.
  Load it and issue the certificate with cryptography.
- verify() ignored the failure of crypto.verify() and reported every
  certificate as invalid. Check the signature with cryptography.

Add libsaml/cert_tests.py, which creates, signs and verifies
certificates through that code. 8 of its 11 tests fail without the
change.
@Harshg999 Harshg999 self-assigned this Oct 29, 2026
@github-actions

github-actions Bot commented Oct 29, 2026

Copy link
Copy Markdown

✅ Test files were modified. Ensure that the tests cover all relevant changes. ✅

@github-actions

github-actions Bot commented Oct 29, 2026

Copy link
Copy Markdown

UI Code Coverage Report

Lines Statements Branches Functions
Coverage: 33%
 40.16% (31632/78763) 32.06% (14985/46738) 26.4% (2414/9142)

@github-actions

github-actions Bot commented Oct 29, 2026

Copy link
Copy Markdown

Coverage

Backend Code Coverage Report •
FileStmtsMissBranchBrPartCoverMissing
desktop/core
   generate_requirements.py41912377%161->162, 162, 170->171, 171, 184->185, 185–191
desktop/core/src/desktop
   appmanager.py13420661483%68->71, 71–72, 136->137, 137, 151->152, 152–153, 173, 184–187, 189, 201–203, 205, 235->236, 236, 259->260, 260, 265->267, 267, 270->271, 271, 286->289, 289
   supervisor.py219163646121%113, 122–125, 130–147, 149–158, 162–163, 165–168, 173, 175, 177–181, 183–194, 196–200, 202, 206, 210–214, 218–222, 226, 231–232, 237–238, 241, 254–257, 259–263, 265–269, 272–273, 278–280, 285–289, 291–295, 298, 300–301, 303, 305–306, 308–311, 313, 315–317, 320–321, 323–325, 332, 336–337, 341, 343–345, 347–348, 350–351, 353, 355–357, 361–365, 367–370, 372, 376–382, 384, 387->388, 388
desktop/libs/notebook/src/notebook/connectors
   sql_alchemy.py347951605471%105–108, 110–118, 120–121, 154->168, 187->188, 188, 196->197, 197, 203->204, 204, 224–226, 228, 234–236, 238, 247->250, 255->256, 256, 265->exit, 266->exit, 300->303, 309->321, 310->311, 311, 316–320, 334->343, 336->337, 337, 343, 349–363, 370->375, 375, 388->389, 389, 390->391, 391, 392->393, 393, 394->395, 395, 396->397, 397, 403, 407, 413->exit, 418, 420–426, 428, 431–432, 442->443, 443, 444->445, 445, 457->474, 474–476, 502->510, 547, 550, 553–556, 559, 564–565, 568–569, 571–572, 584–587, 589, 595–597
TOTAL5698928932219731299347% 

@Harshg999 Harshg999 changed the title core] Fix cryptography and setuptools Dependabot alerts [core] Fix cryptography and setuptools Dependabot alerts Oct 29, 2026
agl29
agl29 reviewed Oct 30, 2026
View reviewed changes

@agl29 agl29 left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

@Harshg999
Harshg999 merged commit 0b50a46 into master Oct 30, 2026
6 checks passed
@Harshg999
Harshg999 deleted the fix/dependabot-cryptography-setuptools branch October 30, 2026 07:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@agl29 agl29 agl29 approved these changes
@tabraiz12 tabraiz12 Awaiting requested review from tabraiz12
@JohanAhlen JohanAhlen Awaiting requested review from JohanAhlen

Assignees

@Harshg999 Harshg999

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@Harshg999 @agl29