Updated files and patched dependencies by carloscumpian · Pull Request #49 · IBM/detect-secrets-stream

carloscumpian · 2025-11-20T00:32:17Z

Changes:

Python 3.12 Upgrade ✅

Upgraded from Python 3.9.21 to Python 3.12.12
- Dockerfiles/Dockerfile.dss
- .travis.yml
- Pipfile
Fixed async/await syntax (removed deprecated @asyncio.coroutine)
- detect_secrets_stream/scan_worker/app.py
- detect_secrets_stream/scan_worker/diffscanworker.py
Updated 26+ packages for CVE fixes
- Pipfile
- Dockerfiles/Dockerfile.dss
All services running with Python 3.12
- tested w/ steps in: https://github.com/IBM/detect-secrets-stream/tree/main/kustomize_envs/dev#local-end-2-end-test
- tested w/ own Win-Menu/test-repo2 repo and created GH App to test

Package Updates

dev packages	old	new	level of change
pytest	8.1.1	8.3.4	Minor update
responses	0.20.0	0.25.3	Minor update
mock	4.0.3	5.1.0	Major update
pre-commit	3.7.0	4.0.1	Major update
flake8	4.0.1	7.1.1	Major update
autopep8	1.6.0	2.3.1	Major update
pipenv	2023.12.1	2024.4.0	Version update
pep8-naming	0.12.1	0.14.1	Minor update
pytest-cov	3.0.0	6.0.0	Major update
packages	--	--	--
confluent-kafka	2.5.0	2.6.1	Minor update
prometheus-client	0.14.0	0.21.1	Minor update
psycopg2-binary	2.9.3	2.9.10	Patch update
click	8.1.2	8.1.8	Patch update
flask	2.2.5	3.1.1	Major update
backoff	1.11.1	2.2.1	Major update
boxsdk[jwt]	3.2.0	3.12.0	Minor update
cryptography	43.0.1	44.0.1	Minor update (CVE fix)
hvac	0.11.2	2.3.0	Major update
requests	2.32.3	2.32.5	Patch update
gunicorn	22.0.0	23.0.0	Major update
gevent	23.9.1	24.11.1	Major update
pyjwt	2.5.0	2.10.1	Minor update
ibm-db	3.2.6	3.2.7	Patch update
Werkzeug	3.0.6	3.1.5	Minor update
detect-secrets	0.13.1+ibm.62.dss	0.13.1+ibm.64.dss	Custom version update
new packages	--	--
certifi	2024.12.14	SSL certificate bundle
typing-extensions	4.12.2	Backported typing features
packaging	24.2	Core packaging utilities
zope.interface	7.2	Interface definitions (gevent dependency)
zope.event	5.0	Event system (gevent dependency)

detect-secrets pre-commit: 0.13.1+ibm.55.dss → 0.13.1+ibm.64.dss

Deployment Verification 🧪

All 5 pods running (gd-ingest, gd-revoker, postgres, scan-worker, vault)
Container structure tests: PASSED (2/2)
Health checks: All services operational
Vault: Initialized, unsealed, read/write working
Port forwarding: Active on all services

Pre-commit Hook Fixed ✅

Updated .pre-commit-config.yaml to use detect-secrets 0.13.1+ibm.64.dss
Version warning eliminated
Pre-commit hooks working correctly

Vault Configuration ✅

sleep added to 10 - kept in vault_init.sh - was timing out when testing/vault was not setting up correctly

Documentation ✅

Updated kustomize_envs/dev/README.md with additional testing procedures
Added verification commands for all services

Signed-off-by: Caleb Cumpian <Carlos.Cumpian@ibm.com>

- Pin pipenv to version 2024.4.0 (same as Dockerfile) - Update Trivy skip-dirs from python3.9 to python3.12 - Fixes ImportError: cannot import name 'dedup' from 'pipenv.vendor.pythonfinder.utils' Signed-off-by: Caleb Cumpian <Carlos.Cumpian@ibm.com>

- Updated cryptography from 44.0.0 to 44.0.1 - Fixes CVE-2024-12797 (NULL pointer dereference vulnerability) - Regenerated Pipfile.lock Signed-off-by: Caleb Cumpian <Carlos.Cumpian@ibm.com>

Convert f-strings from single-quoted outer strings with double-quoted dict keys to double-quoted outer strings with single-quoted dict keys. This satisfies the pre-commit double-quote-string-fixer hook which was failing in Travis CI. Changes to detect_secrets_stream/util/secret_util.py: - Lines 991-1002: Fixed f-strings in ingest_commit function - Lines 1112-1124: Fixed f-strings in rescan_commit function Changes to .flake8: - Added E231 ignore for secret_util.py to suppress false positives on URL strings containing '://' which flake8 incorrectly flags as needing whitespace after the colon The double-quote-string-fixer hook was incorrectly converting f'text {dict["key"]}' to f'text {dict['key']}' which is a syntax error. The proper format is f"text {dict['key']}" with double quotes outside and single quotes for dict key access inside. Signed-off-by: Caleb Cumpian <Carlos.Cumpian@ibm.com>

Changes to .flake8: - Added global ignore for E231 (missing whitespace after ':') - E231 produces many false positives for URL strings with '://' and f-strings with dictionary key access - This affects 80+ lines across multiple files in the codebase Changes to detect_secrets_stream/notification/tests/org_set_controller_test.py: - Fixed JSON string formatting broken by add-trailing-comma hook - Moved closing ']' bracket back to end of JSON string on line 79 - Removed duplicate closing parenthesis - Ensured proper JSON array closure: '}}]' These changes resolve all remaining pre-commit hook failures in Travis CI. Signed-off-by: Caleb Cumpian <Carlos.Cumpian@ibm.com>

…ing-comma Changes to .flake8: - Expanded ignore list to include E126, E223, E226, E241, E272, E702, W503, W504, N818 - These are either false positives or legacy code style issues - Prevents 20+ flake8 errors across the codebase Changes to .pre-commit-config.yaml: - Excluded org_set_controller_test.py from add-trailing-comma hook - The hook incorrectly reformats JSON string literals, breaking syntax - This file contains multi-line JSON strings that should not be modified Signed-off-by: Caleb Cumpian <Carlos.Cumpian@ibm.com>

carloscumpian · 2025-11-20T16:57:16Z

.flake8

.flake8 - added ignore = E231,E126,E223,E226,E241,E272,E702,W503,W504,N818 since it was giving out errors about whitespace that wasn't needed.

example https:// it was giving warning due it wanting a space between : and /

carloscumpian · 2025-11-20T16:58:56Z

.pre-commit-config.yaml

added an exclude to org_set_controller_test.py under hooks: id: add-trailing comma since it was trying to add a comma that wasn't needed

Dockerfiles/Dockerfile.dss

carloscumpian · 2025-11-20T17:03:20Z

detect_secrets_stream/util/secret_util.py

Added double quotes due to Travis CI complaining about them
The hook was incorrectly converting f'text {dict[\"key\"]}' to f'text {dict['key']}' which is a syntax error. The proper format is f\"text {dict['key']}\" with double quotes outside and single quotes for dict key access inside the f-string." python format doc

skaffold.yaml

krkazmier

as long as the local tests passed with ingesting and building, this looks good to me! i don't know how much adding linux/amd64 in places will affect this though. After this is merged these changes will need to staged against the ibm-cloud-secrets-manager branch and we can work together to do local testing for that before proceeding with creating a new release/image

Signed-off-by: Caleb Cumpian <Carlos.Cumpian@ibm.com>

Updated files and patched dependencies

48460dc

Signed-off-by: Caleb Cumpian <Carlos.Cumpian@ibm.com>

carloscumpian force-pushed the caleb-dss-patching branch from 604a146 to 48460dc Compare November 20, 2025 00:45

carloscumpian added 5 commits November 19, 2025 18:52

Upgrade cryptography to 44.0.1 to fix CVE-2024-12797

0350f5d

- Updated cryptography from 44.0.0 to 44.0.1 - Fixes CVE-2024-12797 (NULL pointer dereference vulnerability) - Regenerated Pipfile.lock Signed-off-by: Caleb Cumpian <Carlos.Cumpian@ibm.com>

carloscumpian commented Nov 20, 2025

View reviewed changes

Dockerfiles/Dockerfile.dss Show resolved Hide resolved

carloscumpian commented Nov 20, 2025

View reviewed changes

skaffold.yaml Show resolved Hide resolved

carloscumpian marked this pull request as ready for review November 24, 2025 15:07

krkazmier previously approved these changes Dec 10, 2025

View reviewed changes

carloscumpian added 2 commits March 4, 2026 12:33

Updated new dependencies + removed platform specification

9e5768d

Signed-off-by: Caleb Cumpian <Carlos.Cumpian@ibm.com>

Update requests + give vault more time

9bf87a0

Signed-off-by: Caleb Cumpian <Carlos.Cumpian@ibm.com>

carloscumpian dismissed krkazmier’s stale review via 17ea416 March 4, 2026 21:22

carloscumpian force-pushed the caleb-dss-patching branch from 17ea416 to 9bf87a0 Compare March 4, 2026 21:27

krkazmier approved these changes Mar 4, 2026

View reviewed changes

krkazmier merged commit 8716587 into IBM:main Mar 5, 2026
1 check passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Updated files and patched dependencies#49

Updated files and patched dependencies#49
krkazmier merged 8 commits intoIBM:mainfrom
carloscumpian:caleb-dss-patching

carloscumpian commented Nov 20, 2025 •

edited

Loading

Uh oh!

carloscumpian Nov 20, 2025

Uh oh!

carloscumpian Nov 20, 2025

Uh oh!

Uh oh!

carloscumpian Nov 20, 2025

Uh oh!

Uh oh!

krkazmier left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

carloscumpian commented Nov 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes:

Python 3.12 Upgrade ✅

Package Updates

Deployment Verification 🧪

Pre-commit Hook Fixed ✅

Vault Configuration ✅

Documentation ✅

Uh oh!

carloscumpian Nov 20, 2025

Choose a reason for hiding this comment

Uh oh!

carloscumpian Nov 20, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

carloscumpian Nov 20, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

krkazmier left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

carloscumpian commented Nov 20, 2025 •

edited

Loading