137 lines
2.5 KiB
Plaintext
Raw Normal View History

2022-06-29 14:35:19 -04:00
#
# This file is autogenerated by pip-compile with Python 3.10
# by the following command:
2022-06-29 14:35:19 -04:00
#
2025-06-17 02:32:06 -04:00
# pip-compile ./test.in
2022-06-29 14:35:19 -04:00
#
annotated-types==0.7.0
# via pydantic
autoflake==2.3.1
2025-06-17 02:32:06 -04:00
# via -r ./test.in
black==25.1.0
2025-06-17 02:32:06 -04:00
# via -r ./test.in
click==8.2.1
2022-06-29 14:35:19 -04:00
# via
2025-06-16 16:29:35 -07:00
# -c requirements/base.txt
2022-06-29 14:35:19 -04:00
# black
2025-06-17 02:32:06 -04:00
coverage[toml]==7.9.1
2022-06-29 14:35:19 -04:00
# via
2025-06-17 02:32:06 -04:00
# -r ./test.in
2022-06-29 14:35:19 -04:00
# pytest-cov
exceptiongroup==1.3.0
# via
2025-06-16 16:29:35 -07:00
# -c requirements/base.txt
# pytest
2025-06-16 16:29:35 -07:00
execnet==2.1.1
# via pytest-xdist
flake8==7.2.0
# via
2025-06-17 02:32:06 -04:00
# -r ./test.in
# flake8-print
flake8-print==5.0.0
2025-06-17 02:32:06 -04:00
# via -r ./test.in
freezegun==1.5.2
2025-06-17 02:32:06 -04:00
# via -r ./test.in
grpcio==1.73.0
# via
2025-06-17 02:32:06 -04:00
# -c requirements/deps/constraints.txt
# -r ./test.in
chore: deprecate stage_for_label_studio (#3968) This PR is to address [a CVE](https://github.com/advisories/GHSA-rgv9-w7jp-m23g) that appeared in a recent scan. The CVE has to do with the package `label_studio_sdk`. This relates to the tool Label Studio, a data labeling platform. We built a staging function that takes a list of elements and converts it to a format suitable for passing to the LabelStudio platform. We don't use the package with the vulnerability in the actual function, we only use it to test the output of the function against the Label Studio API schema. Even the test where we use it is sort of questionable in value, since it's really testing the schema against an old version of the LabelStudio API (we are testing against a recording of the Label Studio API's responses stored using `vcrpy`). Label Studio has fixed the vulnerability as of version 1.0.10 of their SDK, but we're stuck on 1.0.5 because 1.0.6 and above require `numpy<2.0.0`. This leaves us with several choices of resolution, some of which are: 1. Downgrade `numpy` to upgrade `label_studio_sdk` to >=1.0.10 to resolve the CVE 2. Drop `label_studio_sdk` by either removing or rewriting the test. 3. Drop test and dev dependencies from the `unstructured` image. We've decided to do 2. _and_ 3. This PR handles 2., with 3. to be a follow-on PR. Here we add a deprecation notice to `stage_for_label_studio` and remove the offending test. Normally good practice would be to add a warning of future deprecation to the function for a reasonable amount of time, but in order to address the CVE immediately, we're deprecating it right away. ### Testing Install the dependencies (`make install`) into a fresh environment, and `pip list | grep label` should have no results. The scan artifact in CI should contain no "high" or "critical" CVEs.
2025-03-26 18:37:03 -05:00
iniconfig==2.1.0
2022-06-29 14:35:19 -04:00
# via pytest
liccheck==0.9.2
2025-06-17 02:32:06 -04:00
# via -r ./test.in
2022-06-29 14:35:19 -04:00
mccabe==0.7.0
# via flake8
2025-06-17 02:32:06 -04:00
mypy==1.16.1
# via -r ./test.in
mypy-extensions==1.1.0
2022-06-29 14:35:19 -04:00
# via
2025-06-16 16:29:35 -07:00
# -c requirements/base.txt
2022-06-29 14:35:19 -04:00
# black
# mypy
packaging==25.0
# via
2025-06-16 16:29:35 -07:00
# -c requirements/base.txt
# black
# pytest
pathspec==0.12.1
# via
# black
# mypy
platformdirs==4.3.8
2022-06-29 14:35:19 -04:00
# via black
pluggy==1.6.0
# via
# pytest
# pytest-cov
pycodestyle==2.13.0
# via
# flake8
# flake8-print
2025-06-17 02:32:06 -04:00
pydantic==2.11.7
# via -r ./test.in
pydantic-core==2.33.2
# via pydantic
pyflakes==3.3.2
# via
# autoflake
# flake8
pygments==2.19.1
# via pytest
pytest==8.4.0
# via
# pytest-cov
# pytest-mock
2025-06-16 16:29:35 -07:00
# pytest-xdist
pytest-cov==6.2.1
2025-06-17 02:32:06 -04:00
# via -r ./test.in
pytest-mock==3.14.1
2025-06-17 02:32:06 -04:00
# via -r ./test.in
2025-06-16 16:29:35 -07:00
pytest-xdist==3.7.0
2025-06-17 02:32:06 -04:00
# via -r ./test.in
python-dateutil==2.9.0.post0
# via
2025-06-16 16:29:35 -07:00
# -c requirements/base.txt
# freezegun
ruff==0.11.13
2025-06-17 02:32:06 -04:00
# via -r ./test.in
semantic-version==2.10.0
# via liccheck
six==1.17.0
# via
2025-06-16 16:29:35 -07:00
# -c requirements/base.txt
# python-dateutil
toml==0.10.2
# via liccheck
tomli==2.2.1
# via
# autoflake
# black
# coverage
# mypy
# pytest
types-click==7.1.8
2025-06-17 02:32:06 -04:00
# via -r ./test.in
types-markdown==3.8.0.20250415
2025-06-17 02:32:06 -04:00
# via -r ./test.in
types-requests==2.32.4.20250611
2025-06-17 02:32:06 -04:00
# via -r ./test.in
types-tabulate==0.9.0.20241207
2025-06-17 02:32:06 -04:00
# via -r ./test.in
typing-extensions==4.14.0
# via
2025-06-16 16:29:35 -07:00
# -c requirements/base.txt
# black
# exceptiongroup
# mypy
# pydantic
# pydantic-core
# typing-inspection
typing-inspection==0.4.1
# via pydantic
urllib3==2.4.0
# via
2025-06-16 16:29:35 -07:00
# -c requirements/base.txt
2025-06-17 02:32:06 -04:00
# -c requirements/deps/constraints.txt
# types-requests