Repository navigation
Isolate plugin commands and refresh vulnerable runtime dependencies - #546
Merged
Merged
Conversation
harrisonoconnorhover
changed the title
harrisonoconnorhover
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Offline plugin discovery loaded the full deployment CLI, S3/PostgreSQL independently maintained the same run-identity rule, and dependency/image scans found vulnerable versions in the existing builds.
Move plugin commands into their own module and dispatch them directly; share the existing 14-field identity comparison beside RunStore; update AnyIO, urllib3, PyJWT, and OAuthLib, with PyJWT's direct minimum raised to 2.15.1. Refresh flagged system libraries through the existing runtime/starter, Spark, and OCI image package-update steps. Command options, installer pins, persistence schemas, base images, and runtime users remain compatible. No new dependencies, audit exclusions, or scan-rule changes were introduced.
Validation: 2,419 tests passed with local PostgreSQL 17 after the Python updates, plus 139 focused authentication/ingestion checks. Strict runtime-all audit reports no known vulnerabilities. The runtime OS layer and complete Spark/OCI images build for linux/amd64 and scan with zero fixable high/critical findings; user, driver identity, and OCI handler checks passed. Scaffold/release/import checks: 15 passed; OCI image/publication checks: 10 passed. Ruff lint/format, canonical strict typing (509 files), lock consistency, Control contract drift, documentation links, and diff checks passed.
DANDER-285 and the dated quality review record the scope, upstream compatibility notes, and remaining maintenance priorities. One existing Starlette/httpx test-client deprecation warning remains. The scan is repository-wide with targeted manual reading; no new live cloud qualification was performed.