output.txt

Lab 25: Dependency Policy and Safe Upgrades
===========================================


=== Install Required Tools ===

Hit:1 http://ap-south-1.ec2.archive.ubuntu.com/ubuntu noble InRelease
Hit:2 http://ap-south-1.ec2.archive.ubuntu.com/ubuntu noble-updates InRelease
Hit:3 http://ap-south-1.ec2.archive.ubuntu.com/ubuntu noble-backports InRelease
Hit:4 http://security.ubuntu.com/ubuntu noble-security InRelease
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
24 packages can be upgraded. Run 'apt list --upgradable' to see them.

Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
python3 is already the newest version (3.12.3-0ubuntu2).
git is already the newest version (1:2.43.0-1ubuntu7.2).
npm is already the newest version (9.2.0~ds1-2).
The following additional packages will be installed:
  libjs-sphinxdoc libjs-underscore libnode108 libpython3-dev libpython3.12-dev nodejs-doc
  python3-dev python3-pip-whl python3-pkg-resources python3-setuptools python3-setuptools-whl
  python3-wheel python3.12-dev python3.12-venv
Suggested packages:
  python-setuptools-doc
The following NEW packages will be installed:
  libjs-sphinxdoc libjs-underscore libpython3-dev libpython3.12-dev python3-dev python3-pip
  python3-pip-whl python3-setuptools python3-setuptools-whl python3-venv python3-wheel
  python3.12-dev python3.12-venv
The following packages will be upgraded:
  libnode108 nodejs nodejs-doc python3-pkg-resources
4 upgraded, 13 newly installed, 0 to remove and 20 not upgraded.
Need to get 31.8 MB of archives.
After this operation, 43.6 MB of additional disk space will be used.
Fetched 31.8 MB in 3s (10.4 MB/s)
Setting up python3-pip (24.0+dfsg-1ubuntu1.1) ...
Setting up python3.12-venv (3.12.3-1ubuntu0.4) ...
Setting up python3-venv (3.12.3-0ubuntu2) ...
Setting up libnode108:amd64 (18.19.1+dfsg-6ubuntu5) ...
Setting up nodejs (18.19.1+dfsg-6ubuntu5) ...
Setting up nodejs-doc (18.19.1+dfsg-6ubuntu5) ...
Processing triggers for man-db (2.12.0-4build2) ...


=== Verify Installations ===

Python 3.12.3

pip 24.0 from /usr/lib/python3/dist-packages/pip (python 3.12)

v18.19.1

9.2.0

git version 2.43.0


=== Step 1: Create Project Structure ===

total 16
drwxrwxr-x 3 toor toor 4096 Apr 12 12:08 .
drwxrwxr-x 3 toor toor 4096 Apr 12 12:08 ..
-rw-rw-r-- 1 toor toor    0 Apr 12 12:08 requirements-dev.txt
-rw-rw-r-- 1 toor toor    0 Apr 12 12:08 requirements.txt
drwxrwxr-x 5 toor toor 4096 Apr 12 12:08 venv


=== Dependency Upgrade Policy Configuration ===

-rw-rw-r-- 1 toor toor 771 Apr 12 12:10 dependency-policy.yaml


=== Create the sample Python application ===

0


=== Install dependencies ===

Requirement already satisfied: pip in ./venv/lib/python3.12/site-packages (24.0)
Collecting pip
  Downloading pip-25.0.1-py3-none-any.whl.metadata (3.7 kB)
Downloading pip-25.0.1-py3-none-any.whl (1.8 MB)
   ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 1.8/1.8 MB 13.4 MB/s eta 0:00:00
Installing collected packages: pip
  Attempting uninstall: pip
    Found existing installation: pip 24.0
    Uninstalling pip-24.0:
      Successfully uninstalled pip-24.0
Successfully installed pip-25.0.1

Collecting Flask==2.3.3 (from -r requirements.txt (line 1))
  Downloading flask-2.3.3-py3-none-any.whl.metadata (3.6 kB)
Collecting requests==2.31.0 (from -r requirements.txt (line 2))
  Downloading requests-2.31.0-py3-none-any.whl.metadata (4.6 kB)
Collecting Werkzeug==2.3.7 (from -r requirements.txt (line 3))
  Downloading Werkzeug-2.3.7-py3-none-any.whl.metadata (4.1 kB)
Collecting pytest==8.2.2 (from -r requirements-dev.txt (line 2))
  Downloading pytest-8.2.2-py3-none-any.whl.metadata (7.6 kB)
Collecting pytest-cov==5.0.0 (from -r requirements-dev.txt (line 3))
  Downloading pytest_cov-5.0.0-py3-none-any.whl.metadata (27 kB)
Collecting safety==3.2.8 (from -r requirements-dev.txt (line 4))
  Downloading safety-3.2.8-py3-none-any.whl.metadata (36 kB)
Collecting pip-audit==2.7.3 (from -r requirements-dev.txt (line 5))
  Downloading pip_audit-2.7.3-py3-none-any.whl.metadata (26 kB)
Collecting PyYAML==6.0.2 (from -r requirements-dev.txt (line 6))
  Downloading PyYAML-6.0.2-cp312-cp312-manylinux2014_x86_64.whl.metadata (2.1 kB)
Collecting packaging==24.1 (from -r requirements-dev.txt (line 7))
  Downloading packaging-24.1-py3-none-any.whl.metadata (3.2 kB)
Collecting Jinja2>=3.1.2 (from Flask==2.3.3->-r requirements.txt (line 1))
Collecting itsdangerous>=2.1.2 (from Flask==2.3.3->-r requirements.txt (line 1))
Collecting click>=8.1.3 (from Flask==2.3.3->-r requirements.txt (line 1))
Collecting blinker>=1.6.2 (from Flask==2.3.3->-r requirements.txt (line 1))
Collecting charset-normalizer<4,>=2 (from requests==2.31.0->-r requirements.txt (line 2))
Collecting idna<4,>=2.5 (from requests==2.31.0->-r requirements.txt (line 2))
Collecting urllib3<3,>=1.21.1 (from requests==2.31.0->-r requirements.txt (line 2))
Collecting certifi>=2017.4.17 (from requests==2.31.0->-r requirements.txt (line 2))
Collecting iniconfig (from pytest==8.2.2->-r requirements-dev.txt (line 2))
Collecting pluggy<2,>=1.5 (from pytest==8.2.2->-r requirements-dev.txt (line 2))
Collecting coverage>=7.5 (from coverage[toml]>=7.5->pytest-cov==5.0.0->-r requirements-dev.txt (line 3))
Collecting authlib>=1.2.0 (from safety==3.2.8->-r requirements-dev.txt (line 4))
Collecting dparse>=0.6.4 (from safety==3.2.8->-r requirements-dev.txt (line 4))
Collecting filelock<4.0,>=3.16.1 (from safety==3.2.8->-r requirements-dev.txt (line 4))
Collecting httpx (from safety==3.2.8->-r requirements-dev.txt (line 4))
Collecting marshmallow>=3.15.0 (from safety==3.2.8->-r requirements-dev.txt (line 4))
Collecting pydantic>=2.6.0 (from safety==3.2.8->-r requirements-dev.txt (line 4))
Collecting ruamel-yaml>=0.17.21 (from safety==3.2.8->-r requirements-dev.txt (line 4))
Collecting rich (from safety==3.2.8->-r requirements-dev.txt (line 4))
Collecting tomlkit (from safety==3.2.8->-r requirements-dev.txt (line 4))
Collecting CacheControl>=0.13.0 (from CacheControl[filecache]>=0.13.0->pip-audit==2.7.3->-r requirements-dev.txt (line 5))
Collecting cyclonedx-python-lib<8,>=5 (from pip-audit==2.7.3->-r requirements-dev.txt (line 5))
Collecting pip-api>=0.0.28 (from pip-audit==2.7.3->-r requirements-dev.txt (line 5))
Collecting pip-requirements-parser>=32.0.0 (from pip-audit==2.7.3->-r requirements-dev.txt (line 5))
Collecting platformdirs>=4.2.0 (from pip-audit==2.7.3->-r requirements-dev.txt (line 5))
Collecting py-serializable<2.0.0,>=1.1.1 (from cyclonedx-python-lib<8,>=5->pip-audit==2.7.3->-r requirements-dev.txt (line 5))
Collecting sortedcontainers<3.0.0,>=2.4.0 (from cyclonedx-python-lib<8,>=5->pip-audit==2.7.3->-r requirements-dev.txt (line 5))
Downloading flask-2.3.3-py3-none-any.whl (96 kB)
Downloading requests-2.31.0-py3-none-any.whl (62 kB)
Downloading Werkzeug-2.3.7-py3-none-any.whl (242 kB)
Downloading pytest-8.2.2-py3-none-any.whl (339 kB)
Downloading pytest_cov-5.0.0-py3-none-any.whl (21 kB)
Downloading safety-3.2.8-py3-none-any.whl (172 kB)
Downloading pip_audit-2.7.3-py3-none-any.whl (55 kB)
Downloading PyYAML-6.0.2-cp312-cp312-manylinux2014_x86_64.whl (724 kB)
Downloading packaging-24.1-py3-none-any.whl (53 kB)
Installing collected packages: sortedcontainers, urllib3, tomlkit, PyYAML, pluggy, platformdirs, packaging, MarkupSafe, iniconfig, idna, filelock, coverage, click, charset-normalizer, certifi, blinker, Werkzeug, requests, pytest, Jinja2, ruamel-yaml, pytest-cov, Flask, pydantic, marshmallow, httpx, dparse, CacheControl, authlib, py-serializable, pip-requirements-parser, pip-api, cyclonedx-python-lib, rich, safety, pip-audit
Successfully installed CacheControl-0.14.1 Flask-2.3.3 Jinja2-3.1.4 MarkupSafe-3.0.2 PyYAML-6.0.2 Werkzeug-2.3.7 authlib-1.4.0 blinker-1.9.0 certifi-2025.1.31 charset-normalizer-3.4.1 click-8.1.8 coverage-7.6.1 cyclonedx-python-lib-7.6.2 dparse-0.6.4 filelock-3.17.0 httpx-0.28.1 idna-3.10 iniconfig-2.0.0 marshmallow-3.26.1 packaging-24.1 pip-api-0.0.34 pip-audit-2.7.3 pip-requirements-parser-32.0.1 platformdirs-4.3.6 pluggy-1.5.0 py-serializable-1.1.2 pydantic-2.10.6 pytest-8.2.2 pytest-cov-5.0.0 requests-2.31.0 rich-13.9.4 ruamel-yaml-0.18.10 safety-3.2.8 sortedcontainers-2.4.0 tomlkit-0.13.2 urllib3-2.3.0

Package                  Version
------------------------ --------
authlib                  1.4.0
blinker                  1.9.0
CacheControl             0.14.1
certifi                  2025.1.31
charset-normalizer       3.4.1
click                    8.1.8
coverage                 7.6.1
cyclonedx-python-lib     7.6.2
dparse                   0.6.4
filelock                 3.17.0
Flask                    2.3.3
httpx                    0.28.1
idna                     3.10
iniconfig                2.0.0
Jinja2                   3.1.4
marshmallow              3.26.1
MarkupSafe               3.0.2
packaging                24.1
pip                      25.0.1


=== Step 5: Create Dependency Scanning Script ===

-rwxrwxr-x 1 toor toor 6959 Apr 12 12:17 check_dependencies.py


=== Basic syntax check ===

0


=== Run the dependency checker ===

Running dependency security checks...

[1/4] Checking for known vulnerabilities with Safety...
{
  "tool": "safety",
  "status": "completed",
  "exit_code": 0,
  "findings_count": 0,
  "findings": {
    "report_meta": {
      "scan_target": "environment",
      "scanned": 36
    },
    "vulnerabilities": []
  }
}

[2/4] Running pip-audit...
{
  "tool": "pip-audit",
  "status": "completed",
  "exit_code": 0,
  "findings_count": 0,
  "findings": [],
  "raw_output": ""
}

[3/4] Checking installed package licenses...
{
  "non_compliant_packages": [
    {
      "package": "blinker",
      "license": "UNKNOWN"
    },
    {
      "package": "click",
      "license": "UNKNOWN"
    },
    {
      "package": "coverage",
      "license": "Apache-2.0 AND MIT"
    },
    {
      "package": "filelock",
      "license": "UNKNOWN"
    },
    {
      "package": "iniconfig",
      "license": "UNKNOWN"
    },
    {
      "package": "MarkupSafe",
      "license": "Copyright 2010 Pallets"
    },
    {
      "package": "pip",
      "license": "MIT License"
    },
    {
      "package": "pluggy",
      "license": "MIT"
    },
    {
      "package": "pytest",
      "license": "MIT"
    },
    {
      "package": "rich",
      "license": "MIT"
    },
    {
      "package": "urllib3",
      "license": "UNKNOWN"
    }
  ]
}

[4/4] Generating upgrade recommendations...
{
  "status": "completed",
  "recommendations": {
    "patch": [
      {
        "name": "pip",
        "version": "25.0.1",
        "latest_version": "25.0.2",
        "latest_filetype": "wheel",
        "policy_schedule": "immediate",
        "approval": "auto-approve",
        "tests_required": [
          "unit_tests",
          "integration_tests"
        ]
      },
      {
        "name": "requests",
        "version": "2.31.0",
        "latest_version": "2.31.1",
        "latest_filetype": "wheel",
        "policy_schedule": "immediate",
        "approval": "auto-approve",
        "tests_required": [
          "unit_tests",
          "integration_tests"
        ]
      }
    ],
    "minor": [
      {
        "name": "packaging",
        "version": "24.1",
        "latest_version": "24.2",
        "latest_filetype": "wheel",
        "policy_schedule": "weekly",
        "approval": "team-lead",
        "tests_required": [
          "unit_tests",
          "integration_tests",
          "smoke_tests"
        ]
      }
    ],
    "major": [
      {
        "name": "Flask",
        "version": "2.3.3",
        "latest_version": "3.1.0",
        "latest_filetype": "wheel",
        "policy_schedule": "quarterly",
        "approval": "architecture-review",
        "tests_required": [
          "full_test_suite",
          "performance_tests",
          "security_audit"
        ]
      },
      {
        "name": "Werkzeug",
        "version": "2.3.7",
        "latest_version": "3.1.3",
        "latest_filetype": "wheel",
        "policy_schedule": "quarterly",
        "approval": "architecture-review",
        "tests_required": [
          "full_test_suite",
          "performance_tests",
          "security_audit"
        ]
      }
    ],
    "unknown": []
  }
}

Dependency check complete!


=== Check for outdated packages ===

Package    Version Latest Type
---------- ------- ------ -----
Flask      2.3.3   3.1.0  wheel
packaging  24.1    24.2   wheel
pip        25.0.1  25.0.2 wheel
requests   2.31.0  2.31.1 wheel
Werkzeug   2.3.7   3.1.3  wheel


=== Create the test directory ===

drwxrwxr-x 2 toor toor 4096 Apr 12 12:22 tests


=== Quick syntax verification ===

0


=== Execute workflow ===

-rwxrwxr-x 1 toor toor 2365 Apr 12 12:27 test_upgrade.sh


=== Shell syntax verification ===

0


=== Step 3: Create Automated Upgrade Workflow ===

-rwxrwxr-x 1 toor toor 8076 Apr 12 12:33 upgrade_workflow.py


=== Basic syntax verification ===

0


=== Run basic tests ===

============================= test session starts ==============================
platform linux -- Python 3.12.3, pytest-8.2.2, pluggy-1.5.0 -- /home/toor/dependency-lab/python-app/venv/bin/python3
cachedir: .pytest_cache
rootdir: /home/toor/dependency-lab/python-app
plugins: cov-5.0.0
collected 4 items

tests/test_app.py::test_health_check PASSED                              [ 25%]
tests/test_app.py::test_fetch_data PASSED                                [ 50%]
tests/test_app.py::test_fetch_data_error_handling PASSED                 [ 75%]
tests/test_app.py::test_dependency_versions PASSED                       [100%]

============================== 4 passed in 0.41s ===============================


=== Run security checks ===

Running dependency security checks...

[1/4] Checking for known vulnerabilities with Safety...
{
  "tool": "safety",
  "status": "completed",
  "exit_code": 0,
  "findings_count": 0,
  "findings": {
    "report_meta": {
      "scan_target": "environment",
      "scanned": 36
    },
    "vulnerabilities": []
  }
}

[2/4] Running pip-audit...
{
  "tool": "pip-audit",
  "status": "completed",
  "exit_code": 0,
  "findings_count": 0,
  "findings": [],
  "raw_output": ""
}

[3/4] Checking installed package licenses...
{
  "non_compliant_packages": [
    {
      "package": "blinker",
      "license": "UNKNOWN"
    },
    {
      "package": "click",
      "license": "UNKNOWN"
    },
    {
      "package": "coverage",
      "license": "Apache-2.0 AND MIT"
    },
    {
      "package": "filelock",
      "license": "UNKNOWN"
    },
    {
      "package": "MarkupSafe",
      "license": "Copyright 2010 Pallets"
    }
  ]
}

[4/4] Generating upgrade recommendations...
{
  "status": "completed",
  "recommendations": {
    "patch": [
      {
        "name": "pip",
        "version": "25.0.1",
        "latest_version": "25.0.2",
        "latest_filetype": "wheel",
        "policy_schedule": "immediate",
        "approval": "auto-approve",
        "tests_required": [
          "unit_tests",
          "integration_tests"
        ]
      },
      {
        "name": "requests",
        "version": "2.31.0",
        "latest_version": "2.31.1",
        "latest_filetype": "wheel",
        "policy_schedule": "immediate",
        "approval": "auto-approve",
        "tests_required": [
          "unit_tests",
          "integration_tests"
        ]
      }
    ],
    "minor": [
      {
        "name": "packaging",
        "version": "24.1",
        "latest_version": "24.2",
        "latest_filetype": "wheel",
        "policy_schedule": "weekly",
        "approval": "team-lead",
        "tests_required": [
          "unit_tests",
          "integration_tests",
          "smoke_tests"
        ]
      }
    ],
    "major": [
      {
        "name": "Flask",
        "version": "2.3.3",
        "latest_version": "3.1.0",
        "latest_filetype": "wheel",
        "policy_schedule": "quarterly",
        "approval": "architecture-review",
        "tests_required": [
          "full_test_suite",
          "performance_tests",
          "security_audit"
        ]
      }
    ],
    "unknown": []
  }
}

Dependency check complete!


=== Test upgrade script (dry run) ===

=== Dependency Upgrade Testing ===
[1/6] Backing up current environment...
Backup created in backup_20260412_123517
[2/6] Running pre-upgrade tests...
============================= test session starts ==============================
platform linux -- Python 3.12.3, pytest-8.2.2, pluggy-1.5.0 -- /home/toor/dependency-lab/python-app/venv/bin/python3
cachedir: .pytest_cache
rootdir: /home/toor/dependency-lab/python-app
plugins: cov-5.0.0
collected 4 items

tests/test_app.py::test_health_check PASSED
tests/test_app.py::test_fetch_data PASSED
tests/test_app.py::test_fetch_data_error_handling PASSED
tests/test_app.py::test_dependency_versions PASSED

============================== 4 passed in 0.39s ===============================
Running dependency security checks...

[1/4] Checking for known vulnerabilities with Safety...
{
  "tool": "safety",
  "status": "completed",
  "exit_code": 0,
  "findings_count": 0,
  "findings": {
    "report_meta": {
      "scan_target": "environment",
      "scanned": 36
    },
    "vulnerabilities": []
  }
}

[2/4] Running pip-audit...
{
  "tool": "pip-audit",
  "status": "completed",
  "exit_code": 0,
  "findings_count": 0,
  "findings": [],
  "raw_output": ""
}

[3/4] Checking installed package licenses...
{
  "non_compliant_packages": [
    {
      "package": "blinker",
      "license": "UNKNOWN"
    },
    {
      "package": "click",
      "license": "UNKNOWN"
    }
  ]
}

[4/4] Generating upgrade recommendations...
{
  "status": "completed",
  "recommendations": {
    "patch": [
      {
        "name": "requests",
        "version": "2.31.0",
        "latest_version": "2.31.1",
        "latest_filetype": "wheel",
        "policy_schedule": "immediate",
        "approval": "auto-approve",
        "tests_required": [
          "unit_tests",
          "integration_tests"
        ]
      }
    ],
    "minor": [
      {
        "name": "packaging",
        "version": "24.1",
        "latest_version": "24.2",
        "latest_filetype": "wheel",
        "policy_schedule": "weekly",
        "approval": "team-lead",
        "tests_required": [
          "unit_tests",
          "integration_tests",
          "smoke_tests"
        ]
      }
    ],
    "major": [
      {
        "name": "Flask",
        "version": "2.3.3",
        "latest_version": "3.1.0",
        "latest_filetype": "wheel",
        "policy_schedule": "quarterly",
        "approval": "architecture-review",
        "tests_required": [
          "full_test_suite",
          "performance_tests",
          "security_audit"
        ]
      }
    ],
    "unknown": []
  }
}

Dependency check complete!
[3/6] Performing dependency upgrade...
No package specified. Skipping actual upgrade (dry run mode).
[4/6] Running post-upgrade tests...
============================= test session starts ==============================
platform linux -- Python 3.12.3, pytest-8.2.2, pluggy-1.5.0 -- /home/toor/dependency-lab/python-app/venv/bin/python3
cachedir: .pytest_cache
rootdir: /home/toor/dependency-lab/python-app
plugins: cov-5.0.0
collected 4 items

tests/test_app.py::test_health_check PASSED
tests/test_app.py::test_fetch_data PASSED
tests/test_app.py::test_fetch_data_error_handling PASSED
tests/test_app.py::test_dependency_versions PASSED

============================== 4 passed in 0.38s ===============================
[5/6] Running security scan...
Running dependency security checks...
...
Dependency check complete!
[6/6] All tests passed! Upgrade successful.
=== Upgrade testing complete ===


=== Test actual upgrade for one package ===

=== Dependency Upgrade Testing ===
[1/6] Backing up current environment...
Backup created in backup_20260412_123703
[2/6] Running pre-upgrade tests...
============================== 4 passed in 0.39s ===============================
Running dependency security checks...
...
Dependency check complete!
[3/6] Performing dependency upgrade...
Requirement already satisfied: requests in ./venv/lib/python3.12/site-packages (2.31.0)
Collecting requests
  Downloading requests-2.31.1-py3-none-any.whl.metadata (4.7 kB)
Requirement already satisfied: charset-normalizer<4,>=2 in ./venv/lib/python3.12/site-packages (from requests) (3.4.1)
Requirement already satisfied: idna<4,>=2.5 in ./venv/lib/python3.12/site-packages (from requests) (3.10)
Requirement already satisfied: urllib3<3,>=1.21.1 in ./venv/lib/python3.12/site-packages (from requests) (2.3.0)
Requirement already satisfied: certifi>=2017.4.17 in ./venv/lib/python3.12/site-packages (from requests) (2025.1.31)
Downloading requests-2.31.1-py3-none-any.whl (63 kB)
Installing collected packages: requests
  Attempting uninstall: requests
    Found existing installation: requests 2.31.0
    Uninstalling requests-2.31.0:
      Successfully uninstalled requests-2.31.0
Successfully installed requests-2.31.1
[4/6] Running post-upgrade tests...
============================= test session starts ==============================
platform linux -- Python 3.12.3, pytest-8.2.2, pluggy-1.5.0 -- /home/toor/dependency-lab/python-app/venv/bin/python3
cachedir: .pytest_cache
rootdir: /home/toor/dependency-lab/python-app
plugins: cov-5.0.0
collected 4 items

tests/test_app.py::test_health_check PASSED
tests/test_app.py::test_fetch_data PASSED
tests/test_app.py::test_fetch_data_error_handling PASSED
tests/test_app.py::test_dependency_versions FAILED

=================================== FAILURES ===================================
___________________________ test_dependency_versions ____________________________
tests/test_app.py:72: in test_dependency_versions
    assert installed_version == expected_version, (
E   AssertionError: requests version mismatch: installed 2.31.1, expected 2.31.0
=========================== short test summary info ============================
FAILED tests/test_app.py::test_dependency_versions - AssertionError: requests version mismatch: installed 2.31.1, expected 2.31.0
========================= 1 failed, 3 passed in 0.41s ==========================
[6/6] Tests failed! Rolling back...
Rollback complete. Verifying rollback state...
Rollback reason: One or more upgrade validation steps failed.


=== Run workflow initializer ===

Dependency upgrade workflow initialized
Run upgrader.check_outdated_packages() to begin


=== Create the Node.js project for comparison ===

Wrote to /home/toor/dependency-lab/nodejs-app/package.json:

{
  "name": "nodejs-app",
  "version": "1.0.0",
  "description": "",
  "main": "index.js",
  "scripts": {
    "test": "echo \"Error: no test specified\" && exit 1"
  },
  "keywords": [],
  "author": "",
  "license": "ISC"
}


=== Install dependencies ===

npm WARN deprecated inflight@1.0.6: This module is not supported, and leaks memory. Do not use it.
npm WARN deprecated glob@7.2.3: Glob versions prior to v9 are no longer supported

added 353 packages, and audited 354 packages in 19s

47 packages are looking for funding
  run `npm fund` for details

7 vulnerabilities (3 low, 4 high)

To address all issues, run:
  npm audit fix

Run `npm audit` for details.


=== Run security audit ===

# npm audit report

axios  <=1.7.3
Severity: high
Axios is vulnerable to Server-Side Request Forgery - https://github.com/advisories/GHSA-8hc4-vh64-cxmj
fix available via `npm audit fix`
node_modules/axios

body-parser  <1.20.3
Severity: high
body-parser vulnerable to denial of service when url encoding is enabled - https://github.com/advisories/GHSA-qwcr-r2fm-qrc7
fix available via `npm audit fix`
node_modules/body-parser
  express  <=4.21.0 || 5.0.0-alpha.1 - 5.0.0
  Depends on vulnerable versions of body-parser
  Depends on vulnerable versions of cookie
  Depends on vulnerable versions of path-to-regexp
  Depends on vulnerable versions of send
  Depends on vulnerable versions of serve-static
  node_modules/express

7 vulnerabilities (3 low, 4 high)

To address all issues, run:
  npm audit fix


=== Check for outdated packages ===

Package            Current   Wanted   Latest  Location                        Depended by
axios               1.3.0    1.3.0    1.8.4   node_modules/axios              dependency-demo
express            4.18.0   4.18.0   5.1.0   node_modules/express            dependency-demo
jest               29.5.0   29.5.0   30.0.0  node_modules/jest               dependency-demo
npm-check-updates  16.10.0  16.10.0  17.1.3  node_modules/npm-check-updates  dependency-demo


=== Generate dependency management report ===

Report generated: report.md

# Dependency Management Report
Generated: Sat Apr 12 12:44:18 UTC 2026

## Python Project
### Installed Packages


=== Installed Packages ===

### Outdated Packages


=== Verify Task 1: Policy Definition ===

✓ Policy file created

safety, version 3.2.8
✓ Safety installed

pip-audit 2.7.3
✓ Pip-audit installed

Running dependency security checks...
...
Dependency check complete!


=== Verify Task 2: Testing Framework ===

✓ Test directory created

============================= test session starts ==============================
platform linux -- Python 3.12.3, pytest-8.2.2, pluggy-1.5.0 -- /home/toor/dependency-lab/python-app/venv/bin/python3
cachedir: .pytest_cache
rootdir: /home/toor/dependency-lab/python-app
plugins: cov-5.0.0
collected 4 items

tests/test_app.py::test_health_check PASSED
tests/test_app.py::test_fetch_data PASSED
tests/test_app.py::test_fetch_data_error_handling PASSED
tests/test_app.py::test_dependency_versions PASSED

============================== 4 passed in 0.40s ===============================

✓ Upgrade script executable

✓ Report generated

# Dependency Management Report
Generated: Sat Apr 12 12:44:18 UTC 2026

## Python Project
### Installed Packages


=== Issue: Safety or pip-audit not found ===

Requirement already satisfied: Flask==2.3.3 in ./venv/lib/python3.12/site-packages (from -r requirements.txt (line 1)) (2.3.3)
Requirement already satisfied: requests==2.31.0 in ./venv/lib/python3.12/site-packages (from -r requirements.txt (line 2)) (2.31.0)
Requirement already satisfied: Werkzeug==2.3.7 in ./venv/lib/python3.12/site-packages (from -r requirements.txt (line 3)) (2.3.7)
Requirement already satisfied: pytest==8.2.2 in ./venv/lib/python3.12/site-packages (from -r requirements-dev.txt (line 2)) (8.2.2)
Requirement already satisfied: pytest-cov==5.0.0 in ./venv/lib/python3.12/site-packages (from -r requirements-dev.txt (line 3)) (5.0.0)
Requirement already satisfied: safety==3.2.8 in ./venv/lib/python3.12/site-packages (from -r requirements-dev.txt (line 4)) (3.2.8)
Requirement already satisfied: pip-audit==2.7.3 in ./venv/lib/python3.12/site-packages (from -r requirements-dev.txt (line 5)) (2.7.3)
Requirement already satisfied: PyYAML==6.0.2 in ./venv/lib/python3.12/site-packages (from -r requirements-dev.txt (line 6)) (6.0.2)
Requirement already satisfied: packaging==24.1 in ./venv/lib/python3.12/site-packages (from -r requirements-dev.txt (line 7)) (24.1)


=== Issue: Tests fail to import app module ===

============================= test session starts ==============================
platform linux -- Python 3.12.3, pytest-8.2.2, pluggy-1.5.0 -- /home/toor/dependency-lab/python-app/venv/bin/python3
collected 4 items

tests/test_app.py::test_health_check PASSED
tests/test_app.py::test_fetch_data PASSED
tests/test_app.py::test_fetch_data_error_handling PASSED
tests/test_app.py::test_dependency_versions PASSED

============================== 4 passed in 0.40s ===============================


=== Issue: npm audit shows vulnerabilities ===

changed 9 packages, and audited 354 packages in 6s

47 packages are looking for funding
  run `npm fund` for details

found 0 vulnerabilities


=== Issue: Permission denied on scripts ===

-rwxrwxr-x 1 toor toor 6959 Apr 12 12:17 /home/toor/dependency-lab/python-app/check_dependencies.py
-rwxrwxr-x 1 toor toor 2365 Apr 12 12:27 /home/toor/dependency-lab/python-app/test_upgrade.sh
-rwxrwxr-x 1 toor toor 8076 Apr 12 12:33 /home/toor/dependency-lab/python-app/upgrade_workflow.py
-rwxrwxr-x 1 toor toor 1138 Apr 12 12:42 /home/toor/dependency-lab/generate_report.sh


=== Key Takeaways ===

• Always test dependency upgrades in isolated environments
• Automate security scanning to catch vulnerabilities early
• Define clear policies for different update types
• Maintain rollback capabilities for quick recovery
• Document and track all dependency changes