Repository: bird-house/twitcher (language: python)

Issue:
[Snyk] Security upgrade python from 3.11-alpine3.17 to 3.13.0a2-alpine3.17
<p>This PR was automatically created by Snyk using the credentials of a real user.</p><br />![snyk-top-banner](https://github.com/andygongea/OWASP-Benchmark/assets/818805/c518c423-16fe-447e-b67f-ad5a49b5d123)

### Snyk has created this PR to fix 4 vulnerabilities in the dockerfile dependencies of this project.

Keeping your Docker base image up-to-date means you’ll benefit from security fixes in the latest version of your chosen image.

#### Snyk changed the following file(s):

- `Dockerfile`

We recommend upgrading to `python:3.13.0a2-alpine3.17`, as this image has only **15** known vulnerabilities. To do this, merge this pull request, then verify your application still works as expected.



#### Vulnerabilities that will be fixed with an upgrade:

|  | Issue | Score | 
:-------------------------:|:-------------------------|:-------------------------
![high severity](https://res.cloudinary.com/snyk/image/upload/w_20,h_20/v1561977819/icon/h.png 'high severity') | Resource Exhaustion <br/>[SNYK-ALPINE317-EXPAT-6241042](https://snyk.io/vuln/SNYK-ALPINE317-EXPAT-6241042) | &nbsp;&nbsp;**614**&nbsp;&nbsp; 
![high severity](https://res.cloudinary.com/snyk/image/upload/w_20,h_20/v1561977819/icon/h.png 'high severity') | Out-of-Bounds <br/>[SNYK-ALPINE317-SQLITE-6179510](https://snyk.io/vuln/SNYK-ALPINE317-SQLITE-6179510) | &nbsp;&nbsp;**614**&nbsp;&nbsp; 
![medium severity](https://res.cloudinary.com/snyk/image/upload/w_20,h_20/v1561977819/icon/m.png 'medium severity') | Use After Free <br/>[SNYK-ALPINE317-BUSYBOX-7254940](https://snyk.io/vuln/SNYK-ALPINE317-BUSYBOX-7254940) | &nbsp;&nbsp;**586**&nbsp;&nbsp; 
![medium severity](https://res.cloudinary.com/snyk/image/upload/w_20,h_20/v1561977819/icon/m.png 'medium severity') | Use After Free <br/>[SNYK-ALPINE317-BUSYBOX-7254941](https://snyk.io/vuln/SNYK-ALPINE317-BUSYBOX-7254941) | &nbsp;&nbsp;**586**&nbsp;&nbsp; 
![medium severity](https://res.cloudinary.com/snyk/image/upload/w_20,h_20/v1561977819/icon/m.png 'medium severity') | Use After Free <br/>[SNYK-ALPINE317-BUSYBOX-7254941](https://snyk.io/vuln/SNYK-ALPINE317-BUSYBOX-7254941) | &nbsp;&nbsp;**586**&nbsp;&nbsp; 



---

> [!IMPORTANT]
>
> - Check the changes in this PR to ensure they won't cause issues with your project.
> - Max score is 1000. Note that the real score may have changed since the PR was raised.
> - This PR was automatically created by Snyk using the credentials of a real user.

---

**Note:** _You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs._

For more information: <img src="https://api.segment.io/v1/pixel/track?data=eyJ3cml0ZUtleSI6InJyWmxZcEdHY2RyTHZsb0lYd0dUcVg4WkFRTnNCOUEwIiwiYW5vbnltb3VzSWQiOiIxMTU5YjI0YS00OGFlLTQzODYtYWMxMy03MTc3NDExYzYwYTMiLCJldmVudCI6IlBSIHZpZXdlZCIsInByb3BlcnRpZXMiOnsicHJJZCI6IjExNTliMjRhLTQ4YWUtNDM4Ni1hYzEzLTcxNzc0MTFjNjBhMyJ9fQ==" width="0" height="0"/>
🧐 [View latest project report](https://app.snyk.io/org/fmigneault/project/12eeda7d-b578-47e9-8176-fad7126ea3df?utm_source&#x3D;github&amp;utm_medium&#x3D;referral&amp;page&#x3D;fix-pr)
📜 [Customise PR templates](https://docs.snyk.io/scan-using-snyk/pull-requests/snyk-fix-pull-or-merge-requests/customize-pr-templates)
🛠 [Adjust project settings](https://app.snyk.io/org/fmigneault/project/12eeda7d-b578-47e9-8176-fad7126ea3df?utm_source&#x3D;github&amp;utm_medium&#x3D;referral&amp;page&#x3D;fix-pr/settings)
📚 [Read about Snyk's upgrade logic](https://support.snyk.io/hc/en-us/articles/360003891078-Snyk-patches-to-fix-vulnerabilities)

---

**Learn how to fix vulnerabilities with free interactive lessons:**

🦉 [Resource Exhaustion](https://learn.snyk.io/lesson/redos/?loc&#x3D;fix-pr)
🦉 [Use After Free](https://learn.snyk.io/lesson/use-after-free/?loc&#x3D;fix-pr)

[//]: # 'snyk:metadata:{"customTemplate":{"variablesUsed":[],"fieldsUsed":[]},"dependencies":[{"name":"python","from":"3.11-alpine3.17","to":"3.13.0a2-alpine3.17"}],"env":"prod","issuesToFix":[{"exploit_maturity":"No Known Exploit","id":"SNYK-ALPINE317-SQLITE-6179510","priority_score":614,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"severity","label":"high","score":400},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Out-of-Bounds"},{"exploit_maturity":"No Known Exploit","id":"SNYK-ALPINE317-EXPAT-6241042","priority_score":614,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"severity","label":"high","score":400},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Resource Exhaustion"},{"exploit_maturity":"No Known Exploit","id":"SNYK-ALPINE317-BUSYBOX-7254941","priority_score":586,"priority_score_factors":[{"type":"freshness","label":true,"score":71},{"type":"fixability","label":true,"score":214},{"type":"severity","label":"medium","score":300},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Use After Free"},{"exploit_maturity":"No Known Exploit","id":"SNYK-ALPINE317-BUSYBOX-7254940","priority_score":586,"priority_score_factors":[{"type":"freshness","label":true,"score":71},{"type":"fixability","label":true,"score":214},{"type":"severity","label":"medium","score":300},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Use After Free"},{"exploit_maturity":"No Known Exploit","id":"SNYK-ALPINE317-BUSYBOX-7254941","priority_score":586,"priority_score_factors":[{"type":"freshness","label":true,"score":71},{"type":"fixability","label":true,"score":214},{"type":"severity","label":"medium","score":300},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Use After Free"}],"prId":"1159b24a-48ae-4386-ac13-7177411c60a3","prPublicId":"1159b24a-48ae-4386-ac13-7177411c60a3","packageManager":"dockerfile","priorityScoreList":[614,614,586,586],"projectPublicId":"12eeda7d-b578-47e9-8176-fad7126ea3df","projectUrl":"https://app.snyk.io/org/fmigneault/project/12eeda7d-b578-47e9-8176-fad7126ea3df?utm_source=github&utm_medium=referral&page=fix-pr","prType":"fix","templateFieldSources":{"branchName":"default","commitMessage":"default","description":"default","title":"default"},"templateVariants":["updated-fix-title","priorityScore"],"type":"auto","upgrade":["SNYK-ALPINE317-BUSYBOX-7254940","SNYK-ALPINE317-BUSYBOX-7254941","SNYK-ALPINE317-BUSYBOX-7254941","SNYK-ALPINE317-EXPAT-6241042","SNYK-ALPINE317-SQLITE-6179510"],"vulns":["SNYK-ALPINE317-SQLITE-6179510","SNYK-ALPINE317-EXPAT-6241042","SNYK-ALPINE317-BUSYBOX-7254941","SNYK-ALPINE317-BUSYBOX-7254940"],"patch":[],"isBreakingChange":false,"remediationStrategy":"vuln"}'



Discussion / hints:

Fix patch:
diff --git a/CHANGES.rst b/CHANGES.rst
index f0a386a..b304af5 100644
--- a/CHANGES.rst
+++ b/CHANGES.rst
@@ -4,6 +4,13 @@ Changes
 Unreleased
 ==========
 
+Changes:
+
+* Drop Python 3.6, 3.7 support.
+* Deprecate Python 3.8 (EOL 2024-10 planed, supported until then).
+* Add Python 3.12 support.
+* Update docker with latest ``python:3.11-alpine3.20`` base.
+
 0.9.0 (2023-02-08)
 ==================
 
diff --git a/Dockerfile b/Dockerfile
index bd64a2c..2f69e95 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,5 +1,5 @@
 # vim:set ft=dockerfile:
-FROM python:3.11-alpine3.17
+FROM python:3.11-alpine3.20
 LABEL Description="Twitcher" Vendor="Birdhouse" Maintainer="https://github.com/bird-house/twitcher"
 
 # Configure hostname and ports for services
diff --git a/requirements.txt b/requirements.txt
index ef41545..060a622 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -1,6 +1,5 @@
 pyramid>=1.10,<2
 webob
-requests
 argcomplete
 pytz
 lxml
@@ -30,9 +29,9 @@ zope.sqlalchemy>=1.3,!=1.4.*
 # oauth2
 pyramid_oauthlib>=0.4.1
 oauthlib<3
+requests>=2.32.2
 requests_oauthlib<1.2.0
 PyJWT>=2
-# typing extension required for TypedDict
-typing_extensions; python_version < "3.8"
-setuptools<60; python_version <= "3.6"  # pyup: ignore
-setuptools>=65.5.1; python_version >= "3.7"
+setuptools>=71.0.3
+urllib3>=2.2.2
+zipp>=3.19.1
diff --git a/requirements_dev.txt b/requirements_dev.txt
index 3e4cdb8..8893b49 100644
--- a/requirements_dev.txt
+++ b/requirements_dev.txt
@@ -1,3 +1,4 @@
+-r requirements.txt
 pytest>=5.0.0
 pytest-cov
 WebTest
@@ -7,4 +8,4 @@ nbsphinx
 bump2version
 twine
 mock
-tornado>=6.3.3; python_version >= "3.8"  # not directly required, pinned by Snyk to avoid a vulnerability
+tornado>=6.3.3  # not directly required, pinned by Snyk to avoid a vulnerability
diff --git a/setup.py b/setup.py
index c2c2075..6537a70 100644
--- a/setup.py
+++ b/setup.py
@@ -10,7 +10,10 @@
     exec(f.read(), about)
 
 reqs = [line.strip() for line in open('requirements.txt')]
-dev_reqs = [line.strip() for line in open('requirements_dev.txt')]
+dev_reqs = [
+    line.strip() for line in open('requirements_dev.txt')
+    if not line.startswith("-r ")
+]
 
 setup(name='pyramid_twitcher',
       version=about['__version__'],
@@ -24,12 +27,11 @@
           "License :: OSI Approved :: Apache Software License",
           "Natural Language :: English",
           "Programming Language :: Python",
-          "Programming Language :: Python :: 3.6",
-          "Programming Language :: Python :: 3.7",
           "Programming Language :: Python :: 3.8",
           "Programming Language :: Python :: 3.9",
           "Programming Language :: Python :: 3.10",
           "Programming Language :: Python :: 3.11",
+          "Programming Language :: Python :: 3.12",
           "Topic :: Internet :: WWW/HTTP",
           "Topic :: Internet :: WWW/HTTP :: WSGI :: Application",
       ],
@@ -42,7 +44,7 @@
       include_package_data=True,
       zip_safe=False,
       test_suite='twitcher',
-      python_requires=">=3.6, <4",
+      python_requires=">=3.8, <4",
       install_requires=reqs,
       extras_require={
           "dev": dev_reqs,              # pip install ".[dev]"


Test patch:
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 9890192..4644c76 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -7,27 +7,31 @@ on:
   - release
   - workflow_dispatch
 
+# cancel the current workflow if another commit was pushed on the same PR or reference
+# uses the GitHub workflow name to avoid collision with other workflows running on the same PR/reference
+concurrency:
+  group: "${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}"
+  cancel-in-progress: true
+
 jobs:
   # see: https://github.com/fkirc/skip-duplicate-actions
   skip_duplicate:
     continue-on-error: true
     runs-on: ubuntu-latest
     outputs:
-      should_skip: ${{ steps.skip_check.outputs.should_skip }}
+      should_skip: ${{ steps.skip_duplicate.outputs.should_skip && ! contains(github.ref, 'refs/tags') }}
     steps:
       - id: skip_check
         uses: fkirc/skip-duplicate-actions@master
         with:
-          concurrent_skipping: "same_content_newer"
+          concurrent_skipping: "same_content"
           skip_after_successful_duplicate: "true"
           do_not_skip: '["pull_request", "workflow_dispatch", "schedule", "release"]'
 
   # see: https://github.com/actions/setup-python
   tests:
-    # FIXME: https://github.com/fkirc/skip-duplicate-actions/issues/90
-    #   disable for now because the tests never run... somehow similar config works in Magpie...
-    # needs: skip_duplicate
-    # if: ${{ needs.skip_duplicate.outputs.should_skip != 'true' }}
+    needs: skip_duplicate
+    if: ${{ needs.skip_duplicate.outputs.should_skip != 'true' }}
     runs-on: ${{ matrix.os }}
     continue-on-error: ${{ matrix.allow-failure }}
     env:
@@ -42,7 +46,7 @@ jobs:
     strategy:
       matrix:
         os: [ubuntu-latest]
-        python-version: ["3.7", "3.8", "3.9", "3.10", "3.11"]
+        python-version: ["3.9", "3.10", "3.11", "3.12"]
         allow-failure: [false]
         test-case: [test-local]
         include:
@@ -62,8 +66,8 @@ jobs:
             allow-failure: false
             test-case: docker-test
           # deprecated versions
-          - os: ubuntu-20.04
-            python-version: 3.6
+          - os: ubuntu-latest
+            python-version: 3.8  # EOL 2024-10
             allow-failure: false
             test-case: test-local
     steps:
@@ -71,7 +75,7 @@ jobs:
         with:
           fetch-depth: "0"
       - name: Setup Python
-        uses: actions/setup-python@v2
+        uses: actions/setup-python@v5
         if: ${{ matrix.python-version != 'None' }}
         with:
           python-version: ${{ matrix.python-version }}
@@ -83,10 +87,6 @@ jobs:
       - name: Display Packages
         if: ${{ matrix.python-version != 'None' }}
         run: pip freeze
-      #- name: Setup Environment Variables
-      #  uses: c-py/action-dotenv-to-setenv@v2
-      #  with:
-      #    env-file: ./ci/weaver.env
       - name: Display Environment Variables
         run: |
           hash -r
@@ -97,9 +97,10 @@ jobs:
         if: ${{ matrix.python-version == 'None' }}
         run: make docker-stop
       - name: Upload coverage report
-        uses: codecov/codecov-action@v1
+        uses: codecov/codecov-action@v4.0.1
         if: ${{ success() && matrix.test-case == 'coverage' }}
         with:
+          token: ${{ secrets.CODECOV_TOKEN }}
           files: ./coverage/coverage.xml
           fail_ci_if_error: true
           verbose: true
@@ -114,9 +115,9 @@ jobs:
         with:
           fetch-depth: "0"
       - name: Setup Python
-        uses: actions/setup-python@v2
+        uses: actions/setup-python@v5
         with:
-          python-version: "3.7"
+          python-version: "3.11"
       - name: Build Distribution Package
         run: make develop dist
       - name: Push Package to PyPi