From 0632d45a63b67102ab812e7301e1e2f18d99b871 Mon Sep 17 00:00:00 2001 From: Ariel Schulz Date: Mon, 12 Oct 2026 09:33:01 +0200 Subject: [PATCH 1/2] Use vulnerable pytest for demonstration --- poetry.lock | 26 +++++++++++++------------- 1 file changed, 13 insertions(+), 13 deletions(-) diff --git a/poetry.lock b/poetry.lock index a2dcda289..ede4745bc 100644 --- a/poetry.lock +++ b/poetry.lock @@ -1,4 +1,4 @@ -# This file is automatically @generated by Poetry 2.3.0 and should not be changed by hand. +# This file is automatically @generated by Poetry 2.5.1 and should not be changed by hand. [[package]] name = "accessible-pygments" @@ -1124,7 +1124,7 @@ files = [ ] [package.dependencies] -chardet = ">=5.1,<6.dev0 || ==7.*" +chardet = ">=5.1,<6 || ==7.*" cyclonedx-python-lib = {version = ">=8,<12", extras = ["validation"]} packageurl-python = ">=0.11,<2" packaging = ">=22,<27" @@ -3182,10 +3182,10 @@ astroid = ">=4.3.3,<=4.4" colorama = {version = ">=0.4.5", markers = "sys_platform == \"win32\""} dill = [ {version = ">=0.2", markers = "python_version < \"3.11\""}, - {version = ">=0.3.7", markers = "python_version >= \"3.12\""}, {version = ">=0.3.6", markers = "python_version == \"3.11\""}, + {version = ">=0.3.7", markers = "python_version >= \"3.12\""}, ] -isort = ">=5,<5.13 || >5.13,<10" +isort = ">=5,!=5.13,<10" mccabe = ">=0.6,<0.8" platformdirs = ">=2.2" tomli = {version = ">=1.1", markers = "python_version < \"3.11\""} @@ -3244,21 +3244,21 @@ tomli = ">=2.0,<3" [[package]] name = "pytest" -version = "9.1.1" +version = "8.4.2" description = "pytest: simple powerful testing with Python" optional = false -python-versions = ">=3.10" +python-versions = ">=3.9" groups = ["main"] files = [ - {file = "pytest-9.1.1-py3-none-any.whl", hash = "sha256:37a86b45efb9a47a61a36449063e8e18d0cab3161329fc099eb21783169c4f0c"}, - {file = "pytest-9.1.1.tar.gz", hash = "sha256:1088fbde8f2b49d95a549a195707afa7a76a3ce9bcadc26b6d71f0ffda5fe313"}, + {file = "pytest-8.4.2-py3-none-any.whl", hash = "sha256:872f880de3fc3a5bdc88a11b39c9710c3497a547cfa9320bc3c5e62fbf272e79"}, + {file = "pytest-8.4.2.tar.gz", hash = "sha256:86c0d0b93306b961d58d62a4db4879f27fe25513d4b969df351abdddb3c30e01"}, ] [package.dependencies] colorama = {version = ">=0.4", markers = "sys_platform == \"win32\""} exceptiongroup = {version = ">=1", markers = "python_version < \"3.11\""} -iniconfig = ">=1.0.1" -packaging = ">=22" +iniconfig = ">=1" +packaging = ">=20" pluggy = ">=1.5,<2" pygments = ">=2.7.2" tomli = {version = ">=1", markers = "python_version < \"3.11\""} @@ -4441,7 +4441,7 @@ sphinx-jinja2-compat = ">=0.1.0" sphinx-prompt = ">=1.1.0" sphinx-tabs = ">=3.4.7,<3.6.0" tabulate = ">=0.8.7" -typing-extensions = ">=3.7.4.3,<3.10.0.1 || >3.10.0.1" +typing-extensions = ">=3.7.4.3,!=3.10.0.1" [package.extras] all = ["coincidence (>=0.4.3)", "pygments (>=2.7.4,<=2.13.0)"] @@ -4791,7 +4791,7 @@ keyring = {version = ">=21.2.0", markers = "platform_machine != \"ppc64le\" and packaging = ">=24.0" readme-renderer = ">=35.0" requests = ">=2.20" -requests-toolbelt = ">=0.8.0,<0.9.0 || >0.9.0" +requests-toolbelt = ">=0.8.0,!=0.9.0" rfc3986 = ">=1.4.0" rich = ">=12.0.0" urllib3 = ">=1.26.0" @@ -5065,4 +5065,4 @@ files = [ [metadata] lock-version = "2.1" python-versions = ">=3.10,<4.0" -content-hash = "42ca5f32838c56167616328f7eb8e0737869702d9ae0a92222d9719447d02260" +content-hash = "abfcfda8dcd1fc61f0c20f1a9fdb9b18ae4579f3aab75888b41b3ef7032d072c" From b8ec25d2409311d9b782831031411085285fafde Mon Sep 17 00:00:00 2001 From: Ariel Schulz Date: Mon, 12 Oct 2026 09:43:51 +0200 Subject: [PATCH 2/2] Remove branch check --- .github/workflows/dependency-update.yml | 9 --------- .../templates/github/workflows/dependency-update.yml | 9 --------- poetry.lock | 2 +- 3 files changed, 1 insertion(+), 19 deletions(-) diff --git a/.github/workflows/dependency-update.yml b/.github/workflows/dependency-update.yml index c562139d3..36cbc4a65 100644 --- a/.github/workflows/dependency-update.yml +++ b/.github/workflows/dependency-update.yml @@ -23,15 +23,6 @@ jobs: persist-credentials: true fetch-depth: 0 - - name: Fail if not running on the default branch - id: check-branch - if: github.ref != format('refs/heads/{0}', github.event.repository.default_branch) - env: - CURRENT_BRANCH: ${{ github.ref }} - run: | - echo "Not running on the default branch. Current ref is: $CURRENT_BRANCH" - exit 1 - - name: Set up Python & Poetry Environment id: set-up-python-and-poetry-environment uses: exasol/python-toolbox/.github/actions/python-environment@v11 diff --git a/exasol/toolbox/templates/github/workflows/dependency-update.yml b/exasol/toolbox/templates/github/workflows/dependency-update.yml index a4d068151..735f2d72b 100644 --- a/exasol/toolbox/templates/github/workflows/dependency-update.yml +++ b/exasol/toolbox/templates/github/workflows/dependency-update.yml @@ -23,15 +23,6 @@ jobs: persist-credentials: true fetch-depth: 0 - - name: Fail if not running on the default branch - id: check-branch - if: github.ref != format('refs/heads/{0}', github.event.repository.default_branch) - env: - CURRENT_BRANCH: ${{ github.ref }} - run: | - echo "Not running on the default branch. Current ref is: $CURRENT_BRANCH" - exit 1 - - name: Set up Python & Poetry Environment id: set-up-python-and-poetry-environment uses: exasol/python-toolbox/.github/actions/python-environment@v11 diff --git a/poetry.lock b/poetry.lock index ede4745bc..8960ef83e 100644 --- a/poetry.lock +++ b/poetry.lock @@ -5065,4 +5065,4 @@ files = [ [metadata] lock-version = "2.1" python-versions = ">=3.10,<4.0" -content-hash = "abfcfda8dcd1fc61f0c20f1a9fdb9b18ae4579f3aab75888b41b3ef7032d072c" +content-hash = "42ca5f32838c56167616328f7eb8e0737869702d9ae0a92222d9719447d02260"