Merge branch 'master' into jsonschema-3.2

.github/workflows/tox.yml

@@ -12,21 +12,23 @@ on:
 
 jobs:
   tests:
-    runs-on: ubuntu-latest
+    #python 3.6 not available on ubuntu-latest
+    runs-on: ubuntu-20.04
     strategy:
       matrix:
         python-version: ["3.6", "3.8"]
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
       - name: "Set up Python ${{ matrix.python-version }}"
-        uses: actions/setup-python@v2
+        uses: actions/setup-python@v4
         with:
           python-version: "${{ matrix.python-version }}"
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip
-          pip install tox tox-gh-actions
+          pip install -r requirements-ci.txt
+          make clean reqs schemas
       - name: "Run tox for ${{ matrix.python-version }}"
         run: |
-          tox
+          make check

CHANGELOG.rst

@@ -1,6 +1,15 @@
 Changelog
 =========
 
+In Development
+--------------
+
+Changed
+~~~~~~~
+
+* Update networkx >=2.6 for Python 3.8 to fix insecure deserialization #255 (improvement)
+  Contributed by @Stealthii
+
 1.5.0
 -----
 

docs/source/conf.py

@@ -19,14 +19,14 @@
 
 # -- Project information -----------------------------------------------------
 
-project = u'StackStorm Orquesta'
-copyright = u'2018, StackStorm'
-author = u'StackStorm'
+project = "StackStorm Orquesta"
+copyright = "2018-2023, StackStorm"
+author = "StackStorm"
 
 # The short X.Y version
-version = u''
+version = ""
 # The full version, including alpha/beta/rc tags
-release = u''
+release = ""
 
 
 # -- General configuration ---------------------------------------------------
@@ -40,43 +40,43 @@
 # ones.
 extensions = [
     # Add theme as extension so sitemap.xml is generated
-    'sphinx_rtd_theme'
+    "sphinx_rtd_theme"
 ]
 
 # Add any paths that contain templates here, relative to this directory.
-templates_path = ['_templates']
+templates_path = ["_templates"]
 
 # The suffix(es) of source filenames.
 # You can specify multiple suffix as a list of string:
 #
 # source_suffix = ['.rst', '.md']
-source_suffix = '.rst'
+source_suffix = ".rst"
 
 # The master toctree document.
-master_doc = 'index'
+master_doc = "index"
 
 # The language for content autogenerated by Sphinx. Refer to documentation
 # for a list of supported languages.
 #
 # This is also used if you do content translation via gettext catalogs.
 # Usually you set "language" from the command line for these cases.
-language = None
+language = "en"
 
 # List of patterns, relative to source directory, that match files and
 # directories to ignore when looking for source files.
 # This pattern also affects html_static_path and html_extra_path .
 exclude_patterns = []
 
 # The name of the Pygments (syntax highlighting) style to use.
-pygments_style = 'sphinx'
+pygments_style = "sphinx"
 
 
 # -- Options for HTML output -------------------------------------------------
 
 # The theme to use for HTML and HTML Help pages.  See the documentation for
 # a list of builtin themes.
 #
-html_theme = 'sphinx_rtd_theme'
+html_theme = "sphinx_rtd_theme"
 
 # Theme options are theme-specific and customize the look and feel of a theme
 # further.  For a list of options available for each theme, see the
@@ -87,7 +87,7 @@
 # Add any paths that contain custom static files (such as style sheets) here,
 # relative to this directory. They are copied after the builtin static files,
 # so a file named "default.css" will overwrite the builtin "default.css".
-html_static_path = ['_static']
+html_static_path = ["_static"]
 
 # Custom sidebar templates, must be a dictionary that maps document names
 # to template names.
@@ -103,7 +103,7 @@
 # -- Options for HTMLHelp output ---------------------------------------------
 
 # Output file base name for HTML help builder.
-htmlhelp_basename = 'Orquestadoc'
+htmlhelp_basename = "Orquestadoc"
 
 
 # -- Options for LaTeX output ------------------------------------------------
@@ -112,15 +112,12 @@
     # The paper size ('letterpaper' or 'a4paper').
     #
     # 'papersize': 'letterpaper',
-
     # The font size ('10pt', '11pt' or '12pt').
     #
     # 'pointsize': '10pt',
-
     # Additional stuff for the LaTeX preamble.
     #
     # 'preamble': '',
-
     # Latex figure (float) alignment
     #
     # 'figure_align': 'htbp',
@@ -130,19 +127,15 @@
 # (source start file, target name, title,
 #  author, documentclass [howto, manual, or own class]).
 latex_documents = [
-    (master_doc, 'Orquesta.tex', u'Orquesta Documentation',
-     u'StackStorm', 'manual'),
+    (master_doc, "Orquesta.tex", "Orquesta Documentation", "StackStorm", "manual"),
 ]
 
 
 # -- Options for manual page output ------------------------------------------
 
 # One entry per manual page. List of tuples
 # (source start file, name, description, authors, manual section).
-man_pages = [
-    (master_doc, 'orquesta', u'Orquesta Documentation',
-     [author], 1)
-]
+man_pages = [(master_doc, "orquesta", "Orquesta Documentation", [author], 1)]
 
 
 # -- Options for Texinfo output ----------------------------------------------
@@ -151,7 +144,13 @@
 # (source start file, target name, title, author,
 #  dir menu entry, description, category)
 texinfo_documents = [
-    (master_doc, 'Orquesta', u'Orquesta Documentation',
-     author, 'Orquesta', 'One line description of project.',
-     'Miscellaneous'),
+    (
+        master_doc,
+        "Orquesta",
+        "Orquesta Documentation",
+        author,
+        "Orquesta",
+        "One line description of project.",
+        "Miscellaneous",
+    ),
 ]

orquesta/tests/unit/conducting/test_workflow_conductor_data_flow.py

@@ -25,7 +25,6 @@
 
 
 class WorkflowConductorDataFlowTest(test_base.WorkflowConductorTest):
-
     wf_def_yaql = """
     version: 1.0
 
@@ -157,14 +156,14 @@ def assert_data_flow(self, input_value):
 
     def assert_unicode_data_flow(self, input_value):
         inputs = {
-            u"a1": (
+            "a1": (
                 str_util.unicode(input_value, encoding_type="utf-8", force=True)
                 if six.PY2
                 else input_value
             )
         }
 
-        expected_output = {u"a5": inputs["a1"], u"b5": inputs["a1"]}
+        expected_output = {"a5": inputs["a1"], "b5": inputs["a1"]}
 
         self._assert_data_flow(inputs, expected_output)
 

orquesta/tests/unit/utils/test_strings.py

@@ -28,7 +28,7 @@ def test_unescape(self):
     def test_unicode(self):
         self.assertEqual(str_util.unicode(123), 123)
         self.assertEqual(str_util.unicode("foobar"), "foobar")
-        self.assertEqual(str_util.unicode(u"fubar" if six.PY2 else str("fubar")), "fubar")
+        self.assertEqual(str_util.unicode("fubar" if six.PY2 else str("fubar")), "fubar")
         self.assertEqual(str_util.unicode("鐵甲奇俠"), "鐵甲奇俠")
         self.assertEqual(str_util.unicode("\xe9\x90\xb5\xe7\x94\xb2"), "\xe9\x90\xb5\xe7\x94\xb2")
 

requirements-ci.txt

@@ -0,0 +1,4 @@
+# Different versions of tox are required by python version
+tox-gh-actions
+tox==3.28.0 ; python_version == "3.6"
+tox==4.6.4 ; python_version == "3.8"

requirements.txt

@@ -3,7 +3,8 @@ eventlet
 Jinja2>=2.11 # BSD License (3 clause)
 jsonschema!=2.5.0,<3.2.0,>=2.0.0 # MIT
 # networkx v2.6 does not support Python3.6.  Update networkx to match st2
-networkx>=2.5.1,<2.6
+networkx>=2.5.1,<2.6; python_version < '3.7'
+networkx>=2.6,<3; python_version >= '3.7'
 python-dateutil
 PyYAML>=3.1.0 # MIT
 six>=1.9.0