From 9a1e1bfa8e0671d11c4624679d61c0c92ced12b4 Mon Sep 17 00:00:00 2001 From: snyk-bot Date: Mon, 18 Mar 2024 18:27:52 +0000 Subject: [PATCH 1/6] fix: requirements.txt to reduce vulnerabilities The following vulnerabilities are fixed by pinning transitive dependencies: - https://snyk.io/vuln/SNYK-PYTHON-STARLETTE-5538332 --- requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/requirements.txt b/requirements.txt index 18efba2a9f..df66682f72 100644 --- a/requirements.txt +++ b/requirements.txt @@ -46,7 +46,7 @@ semantic-version==2.10.0 # via platformio sniffio==1.3.0 # via anyio -starlette==0.26 +starlette==0.27.0 # via platformio tabulate==0.9.0 # via platformio From c8cfeb8d5d3d64a92aed21ddca86a8c6c55fcf7c Mon Sep 17 00:00:00 2001 From: farmmanic <104205278+farmmanic@users.noreply.github.com> Date: Mon, 18 Mar 2024 15:42:06 -0400 Subject: [PATCH 2/6] Update wled-ci.yml --- .github/workflows/wled-ci.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/wled-ci.yml b/.github/workflows/wled-ci.yml index 03c052dfb0..353616967d 100644 --- a/.github/workflows/wled-ci.yml +++ b/.github/workflows/wled-ci.yml @@ -21,6 +21,7 @@ jobs: python-version: '3.9' - name: upgrade pip run: pip install --upgrade pip + pip-compile - name: Install PlatformIO run: pip install -r requirements.txt - name: Get default environments From ac34302c141cc3fc5ae7429248bddd851cbf0de6 Mon Sep 17 00:00:00 2001 From: farmmanic <104205278+farmmanic@users.noreply.github.com> Date: Mon, 18 Mar 2024 15:44:24 -0400 Subject: [PATCH 3/6] Create labeler.yml --- .github/labeler.yml | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) create mode 100644 .github/labeler.yml diff --git a/.github/labeler.yml b/.github/labeler.yml new file mode 100644 index 0000000000..4613569074 --- /dev/null +++ b/.github/labeler.yml @@ -0,0 +1,22 @@ +# This workflow will triage pull requests and apply a label based on the +# paths that are modified in the pull request. +# +# To use this workflow, you will need to set up a .github/labeler.yml +# file with configuration. For more information, see: +# https://github.com/actions/labeler + +name: Labeler +on: [pull_request_target] + +jobs: + label: + + runs-on: ubuntu-latest + permissions: + contents: read + pull-requests: write + + steps: + - uses: actions/labeler@v4 + with: + repo-token: "${{ secrets.GITHUB_TOKEN }}" From ca4d1451d8a7bda363230d8fc6da258dac7523ed Mon Sep 17 00:00:00 2001 From: farmmanic <104205278+farmmanic@users.noreply.github.com> Date: Mon, 18 Mar 2024 15:44:40 -0400 Subject: [PATCH 4/6] Delete .github/workflows/labeler.yml --- .github/workflows/labeler.yml | 22 ---------------------- 1 file changed, 22 deletions(-) delete mode 100644 .github/workflows/labeler.yml diff --git a/.github/workflows/labeler.yml b/.github/workflows/labeler.yml deleted file mode 100644 index 4613569074..0000000000 --- a/.github/workflows/labeler.yml +++ /dev/null @@ -1,22 +0,0 @@ -# This workflow will triage pull requests and apply a label based on the -# paths that are modified in the pull request. -# -# To use this workflow, you will need to set up a .github/labeler.yml -# file with configuration. For more information, see: -# https://github.com/actions/labeler - -name: Labeler -on: [pull_request_target] - -jobs: - label: - - runs-on: ubuntu-latest - permissions: - contents: read - pull-requests: write - - steps: - - uses: actions/labeler@v4 - with: - repo-token: "${{ secrets.GITHUB_TOKEN }}" From 284d2f05af49ecc0516c449b3afa6d6918fc975f Mon Sep 17 00:00:00 2001 From: farmmanic <104205278+farmmanic@users.noreply.github.com> Date: Mon, 18 Mar 2024 15:45:59 -0400 Subject: [PATCH 5/6] Update wled-ci.yml --- .github/workflows/wled-ci.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/.github/workflows/wled-ci.yml b/.github/workflows/wled-ci.yml index 353616967d..03c052dfb0 100644 --- a/.github/workflows/wled-ci.yml +++ b/.github/workflows/wled-ci.yml @@ -21,7 +21,6 @@ jobs: python-version: '3.9' - name: upgrade pip run: pip install --upgrade pip - pip-compile - name: Install PlatformIO run: pip install -r requirements.txt - name: Get default environments From 872963e50f440b75b041439ab44f442b1fa385d6 Mon Sep 17 00:00:00 2001 From: farmmanic <104205278+farmmanic@users.noreply.github.com> Date: Mon, 18 Mar 2024 15:49:01 -0400 Subject: [PATCH 6/6] Update wled-ci.yml --- .github/workflows/wled-ci.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/wled-ci.yml b/.github/workflows/wled-ci.yml index 03c052dfb0..e7d8dac474 100644 --- a/.github/workflows/wled-ci.yml +++ b/.github/workflows/wled-ci.yml @@ -20,7 +20,9 @@ jobs: with: python-version: '3.9' - name: upgrade pip - run: pip install --upgrade pip + run: | + pip install --upgrade pip + pip-compile requirements.in - name: Install PlatformIO run: pip install -r requirements.txt - name: Get default environments