Merge pull request (#891) from Mendix/develop

* added the metering code

* added logging

* added the sap metering sidecar

* updated the auth token usage

* updated the comments

* updated the env vars

* fix: update cryptography to 46.0.7 to address CVE-2026-39892

- Updated cryptography from 46.0.5 to 46.0.7
- Fixes buffer overflow vulnerability in non-contiguous buffer handling
- Regenerated requirements.txt with Python 3.10
- All unit tests passing (184 passed)
- All linting checks passing

* Bumped the cryptography module version to latest 47.0.0

* Fix CVE-2026-25645 and CVE-2026-34073 by upgrading requests and cryptography

Updated requests from 2.32.5 to 2.33.1 to address CVE-2026-25645.
Updated cryptography from 46.0.5 to 47.0.0 to address CVE-2026-34073.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

* Security/upgrade requests urllib3 CVE fix (#894)

* Security: Upgrade requests to 2.34.2 and urllib3 to 2.7.0

Fixes high-severity CVEs:
- CVE-2026-25645 (requests): Fixed in 2.33.0+
- GHSA-mf9v-mfxr-j63j (urllib3): Streaming API decompression issue
- GHSA-qccp-gfcp-xxvc (urllib3): Cross-origin redirect header leakage

Changes:
- requests: 2.32.5 → 2.34.2
- urllib3: 2.6.3 → 2.7.0
- charset-normalizer: 2.0.3 → 3.4.7 (transitive)
- idna: 3.10 → 3.15 (transitive)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

* Fixes high-severity CVEs:
   - CVE-2026-25645 (requests): Fixed in 2.33.0+
   - GHSA-mf9v-mfxr-j63j (urllib3): Streaming API decompression issue
   - GHSA-qccp-gfcp-xxvc (urllib3): Cross-origin redirect header leakage

---------

Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>

---------

Co-authored-by: bhavin.shah <bhavin.shah@mendix.com>
Co-authored-by: priyal.chawda@mendix.com <priyal.chawda@mendix.com>
Co-authored-by: Piyush <piyush.tiwari@mendix.com>
Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>
Co-authored-by: Bhavin Shah <162097397+bhavinshah-mendix@users.noreply.github.com>

Author: 6 people

buildpack/telemetry/metering.py

@@ -27,6 +27,30 @@ def _is_usage_metering_enabled():
         return True
 
 
+def _is_sap_metering_configured():
+    use_license_server = os.environ.get("MXRUNTIME_License.UseLicenseServer", "false").lower()
+    if use_license_server == "true":
+        return False
+    
+    endpoint = _get_sap_metering_endpoint()
+
+    if not endpoint:
+        logging.warning(
+            "Missing configuration for SAP metering sidecar."
+        )
+        return False
+
+    return True
+
+
+def _get_sap_metering_endpoint():
+    return os.environ.get("METERING_BINARY_PATH", "").strip()
+
+
+def _get_sap_metering_token():
+    return os.environ.get("METERING_BINARY_TOKEN", "").strip()
+
+
 def _get_project_id(file_path):
     try:
         with open(file_path) as file_handle:
@@ -89,6 +113,32 @@ def _is_sidecar_installed():
     return False
 
 
+def _copy_sap_metering_sidecar(build_path, endpoint, token):
+    """Download SAP metering sidecar binary from HTTPS endpoint."""
+    import requests
+
+    sidecar_dir = os.path.join(build_path, NAMESPACE)
+    destination = os.path.join(sidecar_dir, BINARY)
+    util.mkdir_p(sidecar_dir)
+
+    response = requests.get(
+        endpoint,
+        headers={"auth-token": token},
+        stream=True,
+        timeout=60,
+    )
+    response.raise_for_status()
+
+    with open(destination, "wb") as file_handle:
+        for chunk in response.iter_content(chunk_size=8192):
+            if chunk:
+                file_handle.write(chunk)
+
+    logging.info("SAP metering sidecar downloaded successfully")
+    util.set_executable(destination)
+    return destination
+
+
 def stage(buildpack_path, build_path, cache_dir):
     try:
         if _is_usage_metering_enabled():
@@ -105,6 +155,18 @@ def stage(buildpack_path, build_path, cache_dir):
                 os.path.join(build_path, NAMESPACE, SIDECAR_CONFIG_FILE),
                 config,
             )
+        elif _is_sap_metering_configured():
+            endpoint = _get_sap_metering_endpoint()
+            token = _get_sap_metering_token()
+            try:
+                _copy_sap_metering_sidecar(build_path, endpoint, token)
+                logging.info("SAP metering sidecar staged successfully")
+            except Exception:
+                logging.error(
+                    "Encountered an exception while staging the SAP metering sidecar. "
+                    "Continuing buildpack execution."
+                )
+                logging.debug("SAP metering sidecar staging exception details:", exc_info=True)
         else:
             logging.info("Usage metering is NOT enabled")
     except Exception:

requirements.in

@@ -1,11 +1,11 @@
 backoff==2.2.1
 certifi==2024.8.30
-cryptography==46.0.5
+cryptography==47.0.0
 distro==1.9.0
 httplib2==0.22.0
 jinja2==3.1.6
 omegaconf==2.3.0
 psycopg2-binary==2.9.10
 pyyaml==6.0.2
-requests==2.32.5
-urllib3==2.6.3
+requests==2.34.2
+urllib3==2.7.0

requirements.txt

@@ -16,7 +16,7 @@ cffi==2.0.0
     # via cryptography
 charset-normalizer==2.0.3
     # via requests
-cryptography==46.0.5
+cryptography==47.0.0
     # via -r requirements.in
 distro==1.9.0
     # via -r requirements.in
@@ -40,11 +40,11 @@ pyyaml==6.0.2
     # via
     #   -r requirements.in
     #   omegaconf
-requests==2.32.5
+requests==2.34.2
     # via -r requirements.in
 typing-extensions==4.15.0
     # via cryptography
-urllib3==2.6.3
+urllib3==2.7.0
     # via
     #   -r requirements.in
     #   requests