Merge pull request #688 from valory-xyz/fix/security-warnings

Fix security warnings
valory-xyz · Oct 25, 2023 · 24a0dce · 24a0dce
2 parents 26a7a90 + 0ae6e79
commit 24a0dce
Show file tree

Hide file tree

Showing 13 changed files with 20 additions and 20 deletions.
diff --git a/Pipfile b/Pipfile
@@ -11,7 +11,7 @@ name = "test-pypi"
 [dev-packages]
 # we fix exact versions as it's sufficient to have at least one set of compatible dependencies for development
 setuptools = "==59.6.0"
-aiohttp = "==3.7.4.post0"
+aiohttp = ">=3.8.5,<4.0.0"
 asn1crypto = "==1.4.0"
 bech32 = "==1.2.0"
 defusedxml = "==0.6.0"
@@ -35,7 +35,7 @@ protobuf = ">=4.21.6,<5.0.0"
 psutil = "==5.7.0"
 pycryptodome = ">=3.10.1"
 pytest-custom-exit-code = "==0.3.0"
-GitPython = "==3.1.27"
+GitPython = "<4.0.0,>=3.1.37"
 requests = "==2.28.1"
 idna = "<=3.3"
 open-aea-cosmpy = "==0.6.7"

diff --git a/docs/http-connection-and-skill.md b/docs/http-connection-and-skill.md
@@ -29,7 +29,7 @@ Add the http server connection package:
 mkdir packages
 aea create my_aea
 cd my_aea
-aea add connection valory/http_server:0.22.0:bafybeie3d6tj2kzewced4nnttxdvr7njue2ortvawmwdt67gwf4tcuosom --remote
+aea add connection valory/http_server:0.22.0:bafybeid4nl6ruidpto3ynwjmc76nf42egcroqlhqq6krh2onwktu4ywpne --remote
 aea push connection valory/http_server --local
 aea add protocol fetchai/default:1.0.0:bafybeibtqp56jkijwjsohk4z5vqp6pfkiexmnmk5uleteotbsgrypy6gxm --remote
 aea push protocol fetchai/default --local

diff --git a/docs/http-echo-demo.md b/docs/http-echo-demo.md
@@ -16,7 +16,7 @@ The easiest way to get started with the http server is to use our pre-built exam
 
 ``` bash
 pipenv shell
-aea fetch open_aea/http_echo:0.1.0:bafybeiaosh5h4msjh4rubd3xnygpqco47hjv4zbt6cz4zrai6zmvd77bv4 --remote
+aea fetch open_aea/http_echo:0.1.0:bafybeiah75oosb24i3nwtbotqjd44waxg7ldmxgle4iiumemgbrvlosxsu --remote
 cd http_echo
 aea generate-key ethereum; aea add-key ethereum
 aea install

diff --git a/packages/open_aea/agents/http_echo/aea-config.yaml b/packages/open_aea/agents/http_echo/aea-config.yaml
@@ -8,7 +8,7 @@ fingerprint:
   README.md: bafybeibkr6ecv5efx3hwxvxposvpmr76ugrj6kydeasb7bppo3ibynnjcu
 fingerprint_ignore_patterns: []
 connections:
-- valory/http_server:0.22.0:bafybeie3d6tj2kzewced4nnttxdvr7njue2ortvawmwdt67gwf4tcuosom
+- valory/http_server:0.22.0:bafybeid4nl6ruidpto3ynwjmc76nf42egcroqlhqq6krh2onwktu4ywpne
 contracts: []
 protocols:
 - fetchai/default:1.0.0:bafybeibtqp56jkijwjsohk4z5vqp6pfkiexmnmk5uleteotbsgrypy6gxm

diff --git a/packages/packages.json b/packages/packages.json
@@ -9,10 +9,10 @@
         "protocol/valory/ledger_api/1.0.0": "bafybeige5agrztgzfevyglf7mb4o7pzfttmq4f6zi765y4g2zvftbyowru",
         "connection/fetchai/stub/0.21.0": "bafybeictgpdqbpyppmoxn2g7jkaxvulihew7zaszv4xyhgvsntq7tqs7wi",
         "connection/valory/ledger/0.19.0": "bafybeigdckv3e6bz6kfloz4ucqrsufft6k4jp6bwkbbcvh4fxvgbmzq3dm",
-        "connection/valory/http_server/0.22.0": "bafybeie3d6tj2kzewced4nnttxdvr7njue2ortvawmwdt67gwf4tcuosom",
+        "connection/valory/http_server/0.22.0": "bafybeid4nl6ruidpto3ynwjmc76nf42egcroqlhqq6krh2onwktu4ywpne",
         "connection/valory/p2p_libp2p/0.1.0": "bafybeiaykya7tvir7k5scovjzuagpfcftvptxoi2od5qqqvukwglsrrtzy",
         "connection/valory/p2p_libp2p_client/0.1.0": "bafybeihge56dn3xep2dzomu7rtvbgo4uc2qqh7ljl3fubqdi2lq44gs5lq",
-        "connection/valory/p2p_libp2p_mailbox/0.1.0": "bafybeieufv6tbei3vza7bg7ggzsvyvwmzps5kghxlar3drhme6d7mxawvy",
+        "connection/valory/p2p_libp2p_mailbox/0.1.0": "bafybeiajf6msadxrr2rgkgebwlzoiznxdccsyzjopm2pkommcgcamsw27m",
         "contract/fetchai/erc1155/0.22.0": "bafybeiff7a6xncyad53o2r7lekpnhexcspze6ocy55xtpzqeuacnlpunm4",
         "protocol/fetchai/fipa/1.0.0": "bafybeid6o7dxutkendclxxtxo3pyizrfho3vxyj5j5sowkysmuqamywb24",
         "protocol/fetchai/oef_search/1.0.0": "bafybeicysyqgag7gsbpvly5mzhlwwiosl7gupgmohx233gynw7xtgsxewy",
@@ -26,11 +26,11 @@
         "agent/fetchai/gym_aea/0.25.0": "bafybeif5c657r3ixuosbyihtsdzr2tqifikxgy5e6t7ur2jmhtiolina3m",
         "agent/fetchai/my_first_aea/0.27.0": "bafybeicrgya4gln4lqr3ba76t2cuyik37lcgr64kzna2fkoseseobytaa4",
         "agent/open_aea/gym_aea/0.1.0": "bafybeibyyl4wtnrfxeoed3kjnlftphkcikdqrgf76u34v4wbvwgsqfqrgy",
-        "agent/open_aea/http_echo/0.1.0": "bafybeiaosh5h4msjh4rubd3xnygpqco47hjv4zbt6cz4zrai6zmvd77bv4",
+        "agent/open_aea/http_echo/0.1.0": "bafybeiah75oosb24i3nwtbotqjd44waxg7ldmxgle4iiumemgbrvlosxsu",
         "agent/open_aea/my_first_aea/0.1.0": "bafybeibv7nlyxldyj5ntivsu74ylul4dltpfvkfa46k2pbveetfpkvz4jm",
         "connection/fetchai/local/0.20.0": "bafybeigukufpgy2sdkv5qqde47dhigbjitxcrxwg6sl6unlpbc7wbxqyhm",
-        "connection/valory/http_client/0.23.0": "bafybeifgeqgryx6b3s6eseyzyezygmeitcpt3tkor2eiycozoi6clgdrny",
-        "connection/valory/test_libp2p/0.1.0": "bafybeih4vz7pprbjhe5g4tnf52ttkooii66woxbhifjc7wk5xdt6b6asiu",
+        "connection/valory/http_client/0.23.0": "bafybeiddrfvomrmgvh5yuv2coq7ci72wcdf663stayi3m5aawnj4srggce",
+        "connection/valory/test_libp2p/0.1.0": "bafybeidy7qyswtj2fnh2q3qnusevamllw2ozzu723sh52r4k4gna3ig4e4",
         "protocol/fetchai/tac/1.0.0": "bafybeiaukfwe7wbpikztprlmrfpphsxqpdzgamkbhvqyz54tl3k73kzsvi",
         "skill/fetchai/erc1155_client/0.28.0": "bafybeid3npgiuvgjyocxtxl6ovihrnicd5ezlim4aq4ytl3atnm5yywxmu",
         "skill/fetchai/erc1155_deploy/0.30.0": "bafybeie2lqwsqgpv35uy7nztohtukvogntsxqi74x37qsbsx7drgeajtau",

diff --git a/packages/valory/connections/http_client/connection.yaml b/packages/valory/connections/http_client/connection.yaml
@@ -25,7 +25,7 @@ restricted_to_protocols:
 - valory/http:1.0.0
 dependencies:
   aiohttp:
-    version: <3.8,>=3.7.4
+    version: <4.0.0,>=3.8.5
   certifi: {}
   multidict: {}
 is_abstract: false
diff --git a/packages/valory/connections/http_server/connection.yaml b/packages/valory/connections/http_server/connection.yaml
@@ -33,7 +33,7 @@ restricted_to_protocols:
 - valory/http:1.0.0
 dependencies:
   aiohttp:
-    version: <3.8,>=3.7.4
+    version: <4.0.0,>=3.8.5
   openapi-core:
     version: ==0.13.2
   openapi-spec-validator:

diff --git a/packages/valory/connections/p2p_libp2p_mailbox/connection.yaml b/packages/valory/connections/p2p_libp2p_mailbox/connection.yaml
@@ -42,7 +42,7 @@ excluded_protocols: []
 restricted_to_protocols: []
 dependencies:
   aiohttp:
-    version: <3.8,>=3.7.4
+    version: <4.0.0,>=3.8.5
   asn1crypto:
     version: <1.5.0,>=1.4.0
   ecdsa: {}

diff --git a/packages/valory/connections/test_libp2p/connection.yaml b/packages/valory/connections/test_libp2p/connection.yaml
@@ -36,7 +36,7 @@ fingerprint_ignore_patterns: []
 connections:
 - valory/p2p_libp2p:0.1.0:bafybeiaykya7tvir7k5scovjzuagpfcftvptxoi2od5qqqvukwglsrrtzy
 - valory/p2p_libp2p_client:0.1.0:bafybeihge56dn3xep2dzomu7rtvbgo4uc2qqh7ljl3fubqdi2lq44gs5lq
-- valory/p2p_libp2p_mailbox:0.1.0:bafybeieufv6tbei3vza7bg7ggzsvyvwmzps5kghxlar3drhme6d7mxawvy
+- valory/p2p_libp2p_mailbox:0.1.0:bafybeiajf6msadxrr2rgkgebwlzoiznxdccsyzjopm2pkommcgcamsw27m
 protocols:
 - fetchai/default:1.0.0:bafybeibtqp56jkijwjsohk4z5vqp6pfkiexmnmk5uleteotbsgrypy6gxm
 - valory/acn:1.1.0:bafybeic2pxzfc3voxl2ejhcqyf2ehm4wm5gxvgx7bliloiqi2uppmq6weu

diff --git a/setup.py b/setup.py
@@ -60,7 +60,7 @@ def get_all_extras() -> Dict:
     "protobuf>=4.21.6,<5.0.0",
     "pymultihash==0.8.2",
     "pyyaml==6.0.1",
-    "requests>=2.22.0,<3.0.0",
+    "requests==2.28.1",
     "python-dotenv>=0.14.0,<0.18.0",
     "ecdsa>=0.15,<0.17.0",
     "morphys>=1.0",

diff --git a/tests/test_docs/test_bash_yaml/md_files/bash-http-connection-and-skill.md b/tests/test_docs/test_bash_yaml/md_files/bash-http-connection-and-skill.md
@@ -3,7 +3,7 @@ aea create my_aea
 cd my_aea
 ```
 ``` bash
-aea add connection valory/http_server:0.22.0:bafybeie3d6tj2kzewced4nnttxdvr7njue2ortvawmwdt67gwf4tcuosom --remote
+aea add connection valory/http_server:0.22.0:bafybeid4nl6ruidpto3ynwjmc76nf42egcroqlhqq6krh2onwktu4ywpne --remote
 ```
 ``` bash
 aea config set agent.default_connection valory/http_server:0.22.0
@@ -48,7 +48,7 @@ models:
 mkdir packages
 aea create my_aea
 cd my_aea
-aea add connection valory/http_server:0.22.0:bafybeie3d6tj2kzewced4nnttxdvr7njue2ortvawmwdt67gwf4tcuosom --remote
+aea add connection valory/http_server:0.22.0:bafybeid4nl6ruidpto3ynwjmc76nf42egcroqlhqq6krh2onwktu4ywpne --remote
 aea push connection valory/http_server --local
 aea add protocol fetchai/default:1.0.0:bafybeibtqp56jkijwjsohk4z5vqp6pfkiexmnmk5uleteotbsgrypy6gxm --remote
 aea push protocol fetchai/default --local

diff --git a/tests/test_docs/test_bash_yaml/md_files/bash-http-echo-demo.md b/tests/test_docs/test_bash_yaml/md_files/bash-http-echo-demo.md
@@ -1,6 +1,6 @@
 ``` bash
 pipenv shell
-aea fetch open_aea/http_echo:0.1.0:bafybeiaosh5h4msjh4rubd3xnygpqco47hjv4zbt6cz4zrai6zmvd77bv4 --remote
+aea fetch open_aea/http_echo:0.1.0:bafybeiah75oosb24i3nwtbotqjd44waxg7ldmxgle4iiumemgbrvlosxsu --remote
 cd http_echo
 aea generate-key ethereum; aea add-key ethereum
 aea install

diff --git a/tox.ini b/tox.ini
@@ -13,7 +13,7 @@ skip_missing_interpreters = true
 [packages-deps]
 deps = 
     gym==0.15.6
-    aiohttp==3.7.4.post0
+    aiohttp>=3.8.5,<4.0.0
     gym==0.15.6
     hypothesis==6.21.6
     numpy>=1.18.1
@@ -27,7 +27,7 @@ deps =
     {[packages-deps]deps}
     docker==4.2.0
     pexpect==4.8.0
-    GitPython==3.1.27
+    GitPython<4.0.0,>=3.1.37
     packaging>=23.1,<24.0
     py-multibase>=1.0.0
     py-multicodec>=0.2.0