Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Removes version constraint for lxml #738

Merged
merged 3 commits into from
Jan 6, 2023
Merged

Removes version constraint for lxml #738

merged 3 commits into from
Jan 6, 2023

Conversation

duck-nukem
Copy link
Contributor

Should fix #659

Proposed changes

Eases constraint on lxml as python3-saml 1.5.0 should no longer require anything before 4.7.0 and it'd allow users of python-social-auth to mitigate CVE-2021-43818 by upgrading to a more recent version

Types of changes

Please check the type of change your PR introduces:

  • Release (new release request)
  • Bugfix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Code style update (PEP8, lint, formatting, renaming, etc)
  • Refactoring (no functional changes, no api changes)
  • Breaking change (fix or feature that would cause existing functionality to not work as expected)
  • Build related changes (build process, tests runner, etc)
  • Other (please describe): Dependency update

Checklist

Put an x in the boxes that apply. You can also fill these out after creating
the PR. If you're unsure about any of them, don't hesitate to ask. We're here to
help! This is simply a reminder of what we are going to look for before merging
your code.

  • Lint and unit tests pass locally with my changes
  • I have added tests that prove my fix is effective or that my feature works

No relevant changes to python files at this time

@nijel
Copy link
Member

nijel commented Jan 4, 2023

The CI environment will now need adjustment to avoid installing lxml from binaries, as described in https://github.com/SAML-Toolkits/python3-saml#note. Do you have a clue how to do that easily inside tox?

@duck-nukem
Copy link
Contributor Author

Thanks for the pointer - don't know yet, but I'll do some research and will update the PR. I'll also try running these tests locally to catch issues earlier

tox.ini Outdated Show resolved Hide resolved
@codecov
Copy link

codecov bot commented Jan 6, 2023

Codecov Report

Merging #738 (876d6e4) into master (90a0652) will not change coverage.
The diff coverage is n/a.

@@           Coverage Diff           @@
##           master     #738   +/-   ##
=======================================
  Coverage   77.21%   77.21%           
=======================================
  Files         323      323           
  Lines        9810     9810           
  Branches     1051     1051           
=======================================
  Hits         7575     7575           
  Misses       2080     2080           
  Partials      155      155           
Flag Coverage Δ
unittests 77.21% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

@nijel nijel merged commit a55a652 into python-social-auth:master Jan 6, 2023
@nijel
Copy link
Member

nijel commented Jan 6, 2023

Merged, thanks for your contribution!

@duck-nukem duck-nukem deleted the chore/relax-lxml-version branch January 6, 2023 11:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

Successfully merging this pull request may close these issues.

Why is lxml restricted to specific versions?
2 participants