fix(deps): bump CVE-affected deps [VC-53657, VC-53626] (#204)

* fix(deps): bump CVE-affected deps and replace safety with pip-audit — VC-53657

* fix(deps): address code review findings — VC-53657

* fix(deps): convert setup.py install_requires to range constraints — VC-53626

Author: ndevarapalli-panw

Dockerfile

@@ -2,8 +2,10 @@ FROM python:3.9-slim
 
 WORKDIR /usr/src/app
 
+RUN echo "pip==25.3 --hash=sha256:9655943313a94722b7774661c21049070f6bbb0a1516bf02f7c8d5d9201514cd" \
+    > /tmp/pip-pin.txt && pip install --no-cache-dir --require-hashes -r /tmp/pip-pin.txt
+
 COPY requirements-build.txt ./
-COPY docker-entrypoint.sh ./
 RUN pip install --no-cache-dir --require-hashes -r requirements-build.txt
 
 COPY . .

docker-entrypoint.sh

@@ -6,8 +6,6 @@ set -o pipefail
 
 bandit -r vcert/
 
-# ID 40291 is pip, ignore so we can still test python 2.7
-#Ignoring false-positive issue with pytest. ref: https://github.com/pytest-dev/py/issues/287
-safety check -i 40291 -i 51457
+pip-audit -r requirements-build.txt
 
 pytest -v --junit-xml=junit.xml --junit-prefix=`python -V | tr ' ' '_'` --cov=vcert --cov=vcert.parser --cov=vcert.policy --cov-report term --cov-report xml

requirements-build.in

@@ -1,5 +1,5 @@
 -r requirements.in
-pytest==7.4.3
-pytest-cov==4.1.0
-safety==2.3.5
-bandit==1.7.7
+pip-audit==2.9.0
+pytest==8.4.2
+pytest-cov==7.1.0
+bandit==1.8.6

requirements-build.txt

@@ -1,6 +1,6 @@
 requests==2.32.4
-python-dateutil==2.8.2
-cryptography==45.0.7
+python-dateutil==2.9.0.post0
+cryptography==48.0.1
 six==1.17.0
-ruamel.yaml==0.18.13
-pynacl==1.5.0
+ruamel.yaml==0.18.17
+pynacl==1.6.2

requirements.in

@@ -14,8 +14,9 @@
       version='0.20.0',
       url="https://github.com/Venafi/vcert-python",
       packages=['vcert', 'vcert.parser', 'vcert.policy'],
-      install_requires=['requests==2.32.4', 'python-dateutil==2.8.2', 'six==1.17.0',
-                        'cryptography==45.0.7', 'ruamel.yaml==0.18.13', 'pynacl==1.5.0'],
+      install_requires=['requests>=2.32.4', 'python-dateutil>=2.9.0.post0', 'six>=1.17.0',
+                        'cryptography>=48.0.1,<50', 'ruamel.yaml>=0.18.17,<0.19', 'pynacl>=1.6.2'],
+      python_requires='>=3.9.2,<4',
       description='Python client library for CyberArk Certificate Manager, Self-Hosted and CyberArk Certificate Manager, SaaS.',
       long_description=long_description,
       long_description_content_type="text/markdown",

requirements.txt

@@ -110,7 +110,7 @@ def as_pkcs12(self, passphrase=None):
             p_key = serialization.load_pem_private_key(data=self.key.encode(), password=b_pass,
                                                        backend=default_backend())
         except Exception as e:
-            get_logger().error(msg=f"Error parsing Private Key: {e.message}")
+            get_logger().error(msg=f"Error parsing Private Key: {str(e)}")
             return
 
         name = random_word(10).encode()