Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[CT-3288] [Feature] Remove werkzeug as dependency in 1.4.latest, 1.5.latest #8941

Closed
3 tasks done
buck-omni opened this issue Oct 30, 2023 · 4 comments
Closed
3 tasks done
Labels
enhancement New feature or request

Comments

@buck-omni
Copy link

Is this your first time submitting a feature request?

  • I have read the expectations for open source contributors
  • I have searched the existing issues, and I could not find an existing issue for this feature
  • I am requesting a straightforward extension of existing dbt functionality, rather than a Big Idea better suited to a discussion

Describe the feature

It appears to me that the werkzeug dependency in unused in the 1.4.latest and 1.5.latest branches. It was removed in 1.6 in 73a0dc6

From looking into the repo history, it looks like Werkzeug was added when introducing the RPC server back around version 0.14. My guess is that this was changed along the way and it went unnoticed that werkzeug was no longer used, but I am not certain about that. Perhaps it's been left for some indirect reason that I can't see in just searching this codebase.

I'd like to remove, if possible, due to a dependabot alert received:

Werkzeug DoS: High resource usage when parsing multipart/form-data containing a large part with CR/LF character at the beginning

Describe alternatives you've considered

Werkzeug could also be upgraded, but since it looks like the dependency is unused, removing it would be better.

Who will this benefit?

Anyone receiving this dependabot alert.

Are you interested in contributing this feature?

yes - it's an easy change to make as long as it's acceptable

Anything else?

No response

@buck-omni buck-omni added enhancement New feature or request triage labels Oct 30, 2023
@github-actions github-actions bot changed the title [Feature] Remove werkzeug as dependency in 1.4.latest, 1.5.latest [CT-3288] [Feature] Remove werkzeug as dependency in 1.4.latest, 1.5.latest Oct 30, 2023
@dbeatty10
Copy link
Contributor

Thanks for opening this @buck-omni !

If you open PR(s) for this, we can pass this along to our engineering team for final review.

@buck-omni
Copy link
Author

Thanks @dbeatty10 - PRs are now open

@KaneMorgan
Copy link

We have the same issue with another Werkzeug dependabot on DBT 1.8.0

it looks like CI failed to run on the PR for some reason, is that blocking this?

#8964

@graciegoheen
Copy link
Contributor

Hi! Thanks so much for opening this up. Given that 1.4 and 1.5 are "End of Life", I'm going to close this out since we don't release patches of old versions.

@graciegoheen graciegoheen closed this as not planned Won't fix, can't repro, duplicate, stale Dec 12, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

4 participants