Dependencies update patch

.github/workflows/testing.yml

@@ -25,9 +25,8 @@ jobs:
  tarantool:
  - '1.10'
  - '2.8'
- - '2.x-latest'
+ - '2.10'
  python:
- - '3.5'
  - '3.6'
  - '3.7'
  - '3.8'
@@ -53,40 +52,29 @@ jobs:
  msgpack-deps: 'msgpack==0.6.2'
  - tarantool: '2.8'
  python: '3.10'
- msgpack-deps: 'msgpack==1.0.0'
+ msgpack-deps: 'msgpack==1.0.4'
 
  steps:
  - name: Clone the connector
  uses: actions/checkout@v2
 
  - name: Install tarantool ${{ matrix.tarantool }}
- if: matrix.tarantool != '2.x-latest'
  uses: tarantool/setup-tarantool@v1
  with:
  tarantool-version: ${{ matrix.tarantool }}
 
- - name: Install latest tarantool 2.x
- if: matrix.tarantool == '2.x-latest'
- run: |
- curl -L https://tarantool.io/pre-release/2/installer.sh | sudo bash
- sudo apt install -y tarantool tarantool-dev
-
  - name: Setup Python for tests
  uses: actions/setup-python@v2
  with:
  python-version: ${{ matrix.python }}
 
  - name: Install specific version of msgpack package
- if: startsWith(matrix.msgpack-deps, 'msgpack==') == true
- run: |
- pip install ${{ matrix.msgpack-deps }}
-
- - name: Install specific version of msgpack-python package
- # msgpack package is a replacement for deprecated msgpack-python.
- # To test compatibility with msgpack-python we must ignore
- # requirements.txt install of msgpack package by overwriting it
- # with sed.
- if: startsWith(matrix.msgpack-deps, 'msgpack-python==') == true
+ # We want to enforce using modern msgpack since it has
+ # various vulnerability fixes. But the code is compatible
+ # with older msgpack versions and msgpack-python package.
+ # To this test compatibility we must ignore requirements.txt
+ # install of the newer msgpack package by overwriting it with sed.
+ if: matrix.msgpack-deps != ''
  run: |
  pip install ${{ matrix.msgpack-deps }}
  sed -i -e "s/^msgpack.*$/${{ matrix.msgpack-deps }}/" requirements.txt
@@ -122,10 +110,7 @@ jobs:
  - '1.10.11-0-gf0b0e7ecf-r470'
  - '2.8.3-21-g7d35cd2be-r470'
  - '2.10.0-1-gfa775b383-r486-linux-x86_64'
- python: ['3.5', '3.6', '3.7', '3.8', '3.9', '3.10']
- msgpack-deps:
- # latest msgpack will be installed as a part of requirements.txt
- - ''
+ python: ['3.6', '3.7', '3.8', '3.9', '3.10']
 
  steps:
  - name: Clone the connector
@@ -150,21 +135,6 @@ jobs:
  with:
  python-version: ${{ matrix.python }}
 
- - name: Install specific version of msgpack package
- if: startsWith(matrix.msgpack-deps, 'msgpack==') == true
- run: |
- pip install ${{ matrix.msgpack-deps }}
-
- - name: Install specific version of msgpack-python package
- # msgpack package is a replacement for deprecated msgpack-python.
- # To test compatibility with msgpack-python we must ignore
- # requirements.txt install of msgpack package by overwriting it
- # with sed.
- if: startsWith(matrix.msgpack-deps, 'msgpack-python==') == true
- run: |
- pip install ${{ matrix.msgpack-deps }}
- sed -i -e "s/^msgpack.*$/${{ matrix.msgpack-deps }}/" requirements.txt
-
  - name: Install package requirements
  run: pip install -r requirements.txt
 
@@ -196,6 +166,7 @@ jobs:
  tarantool:
  - '1.10'
  - '2.8'
+ - '2.10.0.g0a5ce0b9c-1'
  python:
  - '3.10'
 
@@ -219,12 +190,20 @@ jobs:
  with:
  distribution: Ubuntu-20.04
 
- - name: Install tarantool ${{ matrix.tarantool }} for WSL
+ - name: Install tarantool ${{ matrix.tarantool }} for WSL (2.8 and older)
+ if: (matrix.tarantool == '1.10') || (matrix.tarantool == '2.8')
  shell: wsl-bash_Ubuntu-20.04 {0}
  run: |
  curl -L https://tarantool.io/installer.sh | VER=${{ matrix.tarantool }} bash -s -- --type "release"
  sudo apt install -y tarantool tarantool-dev
 
+ - name: Install tarantool ${{ matrix.tarantool }} for WSL (2.10 and newer)
+ if: (matrix.tarantool != '1.10') && (matrix.tarantool != '2.8')
+ shell: wsl-bash_Ubuntu-20.04 {0}
+ run: |
+ curl -L https://tarantool.io/release/2/installer.sh | bash -s
+ sudo apt install -y tarantool=${{ matrix.tarantool }} tarantool-dev=${{ matrix.tarantool }}
+
  - name: Setup test tarantool instance
  shell: wsl-bash_Ubuntu-20.04 {0}
  run: |

CHANGELOG.md

@@ -9,6 +9,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Added
 
 ### Changed
+- Bump msgpack requirement to 1.0.4 (PR #223).
+ The only reason of this bump is various vulnerability fixes,
+ msgpack>=0.4.0 and msgpack-python==0.4.0 are still supported.
 
 ### Fixed
 

requirements-test.txt

@@ -1,4 +1,2 @@
 dbapi-compliance==1.15.0
-# Use this pyyaml version to be compatible with Python34-x64 on Windows.
-# See for more details http://help.appveyor.com/discussions/problems/28023.
-pyyaml==5.2b1
+pyyaml==6.0

requirements.txt

@@ -1 +1 @@
-msgpack>=0.4.0
+msgpack>=1.0.4

setup.py

@@ -83,7 +83,7 @@ def find_version(*file_paths):
  cmdclass=cmdclass,
  command_options=command_options,
  install_requires=[
- 'msgpack>=0.4.0',
+ 'msgpack>=1.0.4',
  ],
  python_requires='>=3',
 )