[jtroup]

ENG-9234

what

Upgrade the Python dependencies that grype reports with High or
Critical vulnerabilities, where the fix needs no code change. Each
package moves to its latest release in the same major version. We
skip any release that is less than 7 days old.

Direct dependencies keep exact pins. For transitive dependencies, we
add minimum versions to the block that already did this for h11, and
change its comment to state its purpose. The all_ds group gets its
own block, so a main install does not pull in driver-only packages.

Two packages stop short of the latest release:

• authlib stays on 1.6.x, because 1.7 needs cryptography 45 or
  later.
• setuptools stays below 82, because databend and several namespace
  packages still import pkg_resources, which 82 removes. The
  wheel and jaraco.context copies that setuptools vendors also
  get the fix.

The lockfile also picks up newer dnspython, pyparsing and
typing-extensions as transitive changes.

A new test checks that every default query runner registers. A
runner disables itself when its driver fails to import, so a bump
that breaks a driver would otherwise remove a data source without an
error. The test skips when the all_ds group is not installed.

why

Clear the High and Critical findings that have a direct fix. This
does not fix cryptography, pyopenssl, snowflake-connector-python,
protobuf or urllib3. Each of those needs a larger change.

testing

This relies on the unit suite and the new runner test. The largest
jump is pyjwt from 2.4 to 2.15, which tests/test_authentication.py
covers through the JWT login path.

• grype scan of the CI image for this branch shows none of the
  targeted findings

docs

No docs needed.

---

🤖 Generated with Claude Code

[jtroup]

@cubic-ai

[cubic-dev-ai]

@cubic-ai

@jtroup I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 3 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

Architecture diagram

sequenceDiagram
    participant CI as CI/CD Pipeline
    participant Grype as Grype Scanner
    participant PyPI as PyPI Registry
    participant Poetry as Poetry Install
    participant App as Redash App
    participant Runners as Query Runner Registry
    participant Test as Test Suite

    Note over CI,PyPI: Dependency Resolution Flow
    CI->>Grype: Scan Python dependencies
    Grype-->>CI: Report High/Critical vulns
    CI->>PyPI: Query latest versions (same major)
    PyPI-->>CI: Version information

    CI->>Poetry: Install/update dependencies
    Poetry->>PyPI: Resolve pinned versions
    PyPI-->>Poetry: Package tarballs/wheels

    Note over App,Runners: Runtime Initialization
    Poetry-->>App: Installed packages
    App->>App: Import query runner modules
    App->>Runners: Register available runners
    Runners->>Runners: Self-disable on import failure

    Note over Test,Runners: Verification Flow
    Test->>App: Check default runner registration
    App->>Runners: Query registered modules
    Runners-->>Test: Runner module list

    alt all_ds group installed
        Test->>Runners: Verify all default runners
        alt All runners registered
            Test-->>CI: Test passes
        else Missing runners (except known disabled)
            Test-->>CI: Test fails
        end
    else all_ds group not installed
        Test->>Test: Skip test with skipUnless
    end

    Note over CI,App: Excluded from fix (require larger changes)
    Note over CI,App: cryptography, pyopenssl, snowflake-connector-python, protobuf, urllib3

Loading

_{Re-trigger cubic}

[kevin-birkett]

thanks @jtroup