Repository: pywbem/pywbemtools (language: python)

Issue:
Add .safety-policy.yaml file.
Based on PR # 3002, urllib3 version limit PR to pass tests. Waiting on commit of that PR

Add a safety policy file (.safety_policy.yaml) to replace the list of safety-ignores in the Makefile. This file based on the file in pywbem.

Update the safety ignore entries to account for the new safety issues introduced in May 2023

Note: the safety issue 52510, on Future module was removed from the ignore list since the new version (0.18.3) of that package that fixes the issue has been released in January 2023.  (pywbem issue #2976)

This pr includes changes to both minimum-constraints.txt and dev-requirements.txt to reflect the new safety issues.

NOTE: We  modified the minimum-constraints.txt and, etc. to further separate out the requirements that are specific for python 2.7 and 3.5 in to individual statements in many cases to maybe make it easier when we get to removing requirements for these python versions.


Discussion / hints:
The current failure is because of the problem defined in issue #1301, using urllib3.

Fix patch:
diff --git a/dev-requirements.txt b/dev-requirements.txt
index 1c2ac76a..c96c83b5 100644
--- a/dev-requirements.txt
+++ b/dev-requirements.txt
@@ -28,6 +28,16 @@ colorama>=0.4.5; python_version >= '3.5'
 importlib-metadata>=0.22,<5.0.0; python_version <= '3.7'
 importlib-metadata>=1.1.0; python_version >= '3.8'
 
+# urllib3 version < 2.0.0 required for python < 3.7
+urllib3>=1.25.9,<2.0.0; python_version == '2.7'
+urllib3>=1.25.9,<2.0.0;  python_version == '3.5'
+urllib3>=1.25.9,<2.0.0;  python_version == '3.6'
+# TODO: Following limits use of urllib3 <= 2.0  for python < 3.7 until issues
+# about upgrade resolved. Issue #1302 filed updates urllib3 to version 2.0.
+# Python <= 3.7 required for urllib3 <= 2.0.0
+urllib3>=1.25.9,<2.0.0; python_version >= '3.7' and python_version <= '3.9'
+urllib3>=1.26.5,<2.0.0; python_version >= '3.10'
+
 # more-itertools version 8.11 requires python 3.6, See issue #2796
 more-itertools>=4.0.0,!=8.11.0; python_version < '3.6'
 more-itertools>=4.0.0; python_version >= '3.6'
@@ -176,6 +186,9 @@ packaging>=17.0; python_version == '2.7'
 packaging>=17.0; python_version == '3.5'
 packaging>=21.0,<22.0; python_version >= '3.6'
 
+# urllib3 2.0 requires py>=3.7
+urllib3>=1.25.9,<2.0.0; python_version == '2.7' and python_version >= '3.5'
+urllib3>=1.26.5,<2.0.0; python_version >= '3.10'
 
 # Temporary workarounds on indirectly used packages:
 
diff --git a/minimum-constraints.txt b/minimum-constraints.txt
index 7bddeede..fa1c4111 100644
--- a/minimum-constraints.txt
+++ b/minimum-constraints.txt
@@ -160,7 +160,10 @@ requests==2.25.0; python_version >= '3.10'
 # decorator==4.0.11
 # yamlordereddictloader==0.4.0
 urllib3==1.25.9; python_version == '2.7'
-urllib3==1.25.9; python_version >= '3.5' and python_version <= '3.9'
+urllib3==1.25.9; python_version == '3.5'
+urllib3==1.25.9; python_version == '3.6'
+# urllib3 < 2.0.0 required for python < 3.7
+urllib3==1.25.9; python_version >= '3.7' and python_version <= '3.9'
 urllib3==1.26.5; python_version >= '3.10'
 
 # Direct dependencies for develop (must be consistent with dev-requirements.txt)


Test patch:
diff --git a/tests/unit/pywbemcli/test_pywbemcli_operations.py b/tests/unit/pywbemcli/test_pywbemcli_operations.py
index 153ab1d7..1849cf7e 100644
--- a/tests/unit/pywbemcli/test_pywbemcli_operations.py
+++ b/tests/unit/pywbemcli/test_pywbemcli_operations.py
@@ -48,6 +48,8 @@
 
 PYWBEM_VERSION = packaging.version.parse(pywbem.__version__)
 
+URLLIB3_VERSION = packaging.version.parse(urllib3.__version__)
+
 # Click (as of 7.1.2) raises UnsupportedOperation in click.echo() when
 # the pytest capsys fixture is used. That happens only on Windows.
 # See Click issue https://github.com/pallets/click/issues/1590. This
@@ -74,7 +76,8 @@
 with warnings.catch_warnings():
     warnings.filterwarnings('error')
     try:
-        urllib3.Retry(method_whitelist={})
+        if URLLIB3_VERSION.release < (2):
+            urllib3.Retry(method_whitelist={})
     except (DeprecationWarning, TypeError):
         RETRY_DEPRECATION = PYWBEM_VERSION.release < (1, 1)
     else: