Prepare release 10.0.0 (#521)

* update changed-files action * update requirements * update changelog
fkie-cad · Feb 7, 2024 · 3ccedfa · 3ccedfa
1 parent 28f69ff
commit 3ccedfa
Show file tree

Hide file tree

Showing 6 changed files with 144 additions and 135 deletions.
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -133,7 +133,7 @@ jobs:
 
       - name: Get changed python files
         id: changed-files
-        uses: tj-actions/changed-files@v18.7
+        uses: tj-actions/changed-files@v41
         with:
           files: |
             **/*.py

diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
@@ -102,7 +102,7 @@ jobs:
 
       - name: Get changed python files
         id: changed-files
-        uses: tj-actions/changed-files@v18.7
+        uses: tj-actions/changed-files@v41
         with:
           files: |
             **/*.py

diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -3,6 +3,16 @@
 ## next release
 ### Breaking
 
+### Features
+
+### Improvements
+
+### Bugfix
+
+
+## v10.0.0
+### Breaking
+
 * reimplement the logprep CLI, see `logprep --help` for more information.
 * remove feature to reload configuration by sending signal `SIGUSR1`
 * remove feature to validate rules because it is already included in `logprep test config`
@@ -29,6 +39,7 @@
 * rewrite Runner 
 * delete MultiProcessingPipeline class to simplify multiprocesing
 * add FDA to the quickstart setup
+* bump versions for `fastapi` and `aiohttp` to address CVEs
 
 ### Bugfix
 

diff --git a/requirements.in b/requirements.in
@@ -1,11 +1,11 @@
-aiohttp>=3.8.5 # CVE-2023-37276
+aiohttp>=3.9.2 # CVE-2024-23334
 attrs
 certifi>=2023.7.22 # CVE-2023-37920
 ciso8601 # fastest iso8601 datetime parser. can be removed after dropping support for python < 3.11
 colorama
 confluent-kafka>2
 elasticsearch>=7,<8
-fastapi
+fastapi>=0.109.1 # CVE-2024-24762
 geoip2
 hyperscan>=0.4.0; sys_platform == 'linux' and platform_machine == 'x86_64'
 jsonref

diff --git a/requirements.txt b/requirements.txt
@@ -2,11 +2,11 @@
 # This file is autogenerated by pip-compile with Python 3.11
 # by the following command:
 #
-#    pip-compile ./requirements.in
+#    pip-compile requirements.in
 #
-aiohttp==3.9.1
+aiohttp==3.9.3
     # via
-    #   -r ./requirements.in
+    #   -r requirements.in
     #   geoip2
 aiosignal==1.3.1
     # via aiohttp
@@ -15,41 +15,41 @@ annotated-types==0.6.0
 anyio==4.2.0
     # via starlette
 arrow==1.3.0
-    # via -r ./requirements.in
+    # via -r requirements.in
 attrs==23.2.0
     # via
-    #   -r ./requirements.in
+    #   -r requirements.in
     #   aiohttp
 boto3==1.34.27
-    # via -r ./requirements.in
+    # via -r requirements.in
 botocore==1.34.27
     # via
     #   boto3
     #   s3transfer
 certifi==2023.11.17
     # via
-    #   -r ./requirements.in
+    #   -r requirements.in
     #   elasticsearch
     #   opensearch-py
     #   requests
 charset-normalizer==3.3.2
     # via requests
 ciso8601==2.3.1
-    # via -r ./requirements.in
+    # via -r requirements.in
 click==8.1.7
     # via
-    #   -r ./requirements.in
+    #   -r requirements.in
     #   uvicorn
 colorama==0.4.6
-    # via -r ./requirements.in
+    # via -r requirements.in
 confluent-kafka==2.3.0
-    # via -r ./requirements.in
+    # via -r requirements.in
 deepdiff==6.7.1
-    # via -r ./requirements.in
+    # via -r requirements.in
 elasticsearch==7.17.9
-    # via -r ./requirements.in
-fastapi==0.109.0
-    # via -r ./requirements.in
+    # via -r requirements.in
+fastapi==0.109.1
+    # via -r requirements.in
 filelock==3.13.1
     # via
     #   tldextract
@@ -59,11 +59,11 @@ frozenlist==1.4.1
     #   aiohttp
     #   aiosignal
 geoip2==4.8.0
-    # via -r ./requirements.in
+    # via -r requirements.in
 h11==0.14.0
     # via uvicorn
 hyperscan==0.6.0 ; sys_platform == "linux" and platform_machine == "x86_64"
-    # via -r ./requirements.in
+    # via -r requirements.in
 idna==3.6
     # via
     #   anyio
@@ -77,56 +77,56 @@ jmespath==1.0.1
     #   botocore
 joblib==1.3.2
     # via
-    #   -r ./requirements.in
+    #   -r requirements.in
     #   scikit-learn
 jsonref==1.1.0
-    # via -r ./requirements.in
+    # via -r requirements.in
 luqum==0.13.0
-    # via -r ./requirements.in
+    # via -r requirements.in
 maxminddb==2.5.2
     # via geoip2
 msgspec==0.18.6
-    # via -r ./requirements.in
+    # via -r requirements.in
 multidict==6.0.4
     # via
     #   aiohttp
     #   yarl
 mysql-connector-python==8.3.0
-    # via -r ./requirements.in
+    # via -r requirements.in
 ndjson==0.3.1
-    # via -r ./requirements.in
+    # via -r requirements.in
 numpy==1.26.3
     # via
-    #   -r ./requirements.in
+    #   -r requirements.in
     #   pandas
     #   scikit-learn
     #   scipy
 opensearch-py==2.4.2
-    # via -r ./requirements.in
+    # via -r requirements.in
 ordered-set==4.1.0
     # via deepdiff
 pandas==2.2.0
-    # via -r ./requirements.in
+    # via -r requirements.in
 platformdirs==4.1.0
     # via urlextract
 ply==3.11
     # via luqum
 prometheus-client==0.19.0
-    # via -r ./requirements.in
+    # via -r requirements.in
 protobuf==4.25.2
-    # via -r ./requirements.in
+    # via -r requirements.in
 pycryptodome==3.20.0
-    # via -r ./requirements.in
+    # via -r requirements.in
 pydantic==2.5.3
     # via
-    #   -r ./requirements.in
+    #   -r requirements.in
     #   fastapi
 pydantic-core==2.14.6
     # via pydantic
 pygrok==1.0.0
-    # via -r ./requirements.in
+    # via -r requirements.in
 pyparsing==3.1.1
-    # via -r ./requirements.in
+    # via -r requirements.in
 python-dateutil==2.8.2
     # via
     #   arrow
@@ -135,34 +135,34 @@ python-dateutil==2.8.2
     #   pandas
 pytz==2023.3.post1
     # via
-    #   -r ./requirements.in
+    #   -r requirements.in
     #   pandas
 pyyaml==6.0.1
-    # via -r ./requirements.in
+    # via -r requirements.in
 regex==2023.12.25
     # via pygrok
 requests==2.31.0
     # via
-    #   -r ./requirements.in
+    #   -r requirements.in
     #   geoip2
     #   opensearch-py
     #   requests-file
     #   tldextract
 requests-file==1.5.1
     # via tldextract
 ruamel-yaml==0.18.5
-    # via -r ./requirements.in
+    # via -r requirements.in
 ruamel-yaml-clib==0.2.8
     # via ruamel-yaml
 s3transfer==0.10.0
     # via boto3
 schedule==1.2.1
-    # via -r ./requirements.in
+    # via -r requirements.in
 scikit-learn==1.4.0
-    # via -r ./requirements.in
+    # via -r requirements.in
 scipy==1.12.0
     # via
-    #   -r ./requirements.in
+    #   -r requirements.in
     #   scikit-learn
 six==1.16.0
     # via
@@ -174,11 +174,11 @@ sniffio==1.3.0
 starlette==0.35.1
     # via fastapi
 tabulate==0.9.0
-    # via -r ./requirements.in
+    # via -r requirements.in
 threadpoolctl==3.2.0
     # via scikit-learn
 tldextract==5.1.1
-    # via -r ./requirements.in
+    # via -r requirements.in
 types-python-dateutil==2.8.19.20240106
     # via arrow
 typing-extensions==4.9.0
@@ -191,18 +191,18 @@ tzdata==2023.4
 uritools==4.0.2
     # via urlextract
 urlextract==1.8.0
-    # via -r ./requirements.in
+    # via -r requirements.in
 urllib3==1.26.18
     # via
-    #   -r ./requirements.in
+    #   -r requirements.in
     #   botocore
     #   elasticsearch
     #   opensearch-py
     #   requests
 uvicorn==0.27.0
-    # via -r ./requirements.in
+    # via -r requirements.in
 wheel==0.42.0
-    # via -r ./requirements.in
+    # via -r requirements.in
 yarl==1.9.4
     # via aiohttp