From 488b587ac4b6c8ca39885fc3e9c0c71f4900ed70 Mon Sep 17 00:00:00 2001 From: ahothan Date: Sun, 3 May 2026 09:02:21 -0700 Subject: [PATCH 1/4] Bump dependencies and CI actions for known CVEs Dependencies (transitive, pinned at minimum-safe versions): * setuptools>=78.1.1 in requirements.txt -- closes CVE-2024-6345 (RCE in PackageIndex.download) and CVE-2025-47273 (path traversal in PackageIndex). Affects build-time only. * zipp>=3.19.1 in test-requirements.txt -- closes CVE-2024-5569 (infinite-loop DoS in zipp.Path). Test tools (raise minimum versions to currently-supported lines and shed years of vulnerable transitives): * pytest >=2.7.2 -> >=8.0.0 * pylint >=1.7.1 -> >=3.0.0 * pytest-cov >=2.9 -> >=5.0.0 GitHub Actions (move off EOL Node 16 runtimes; v3 of upload/download- artifact was disabled by GitHub on 2025-01-30): * actions/checkout@v3 -> v4 (both workflows) * actions/setup-python@v3 -> v5 (tox.yml) * actions/upload-artifact@v3 -> v4 (python-publish.yml) with the unique-name-per-matrix-entry change v4 requires * actions/download-artifact@v3 -> v4 (python-publish.yml) with pattern + merge-multiple to re-aggregate the renamed artifacts back into dist/ * pypa/cibuildwheel@v2.15.0 -> v2.21.3 (adds Python 3.13 wheels and ~18 months of CI hardening) Supply-chain hardening: * pypa/gh-action-pypi-publish: replace the moving release/v1 tag with the immutable v1.10.3 tag for the action that holds PyPI publish authority for this project. No source code (Python or C extension) changes; no API or wire-format changes. Only dependency floors and CI/release configuration. Co-authored-by: Cursor --- .github/workflows/python-publish.yml | 25 +++++++++++++++++-------- .github/workflows/tox.yml | 4 ++-- requirements.txt | 3 +++ test-requirements.txt | 9 ++++++--- 4 files changed, 28 insertions(+), 13 deletions(-) diff --git a/.github/workflows/python-publish.yml b/.github/workflows/python-publish.yml index 15207ea..ccb449e 100644 --- a/.github/workflows/python-publish.yml +++ b/.github/workflows/python-publish.yml @@ -25,26 +25,29 @@ jobs: os: [ubuntu-22.04, windows-2022, macos-11] steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@v4 - name: Build wheels - uses: pypa/cibuildwheel@v2.15.0 + uses: pypa/cibuildwheel@v2.21.3 - - uses: actions/upload-artifact@v3 + - uses: actions/upload-artifact@v4 with: + # upload-artifact@v4 requires a unique name per matrix entry. + name: wheels-${{ matrix.os }} path: ./wheelhouse/*.whl build_sdist: name: Build source distribution runs-on: ubuntu-latest steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@v4 - name: Build sdist run: pipx run build --sdist - - uses: actions/upload-artifact@v3 + - uses: actions/upload-artifact@v4 with: + name: sdist path: dist/*.tar.gz upload_pypi: @@ -54,9 +57,15 @@ jobs: permissions: id-token: write steps: - - uses: actions/download-artifact@v3 + - uses: actions/download-artifact@v4 with: - name: artifact + # Pull every artifact from build_wheels (one per matrix os) and + # build_sdist, flattening them into dist/ for the publisher. path: dist + pattern: "*" + merge-multiple: true - - uses: pypa/gh-action-pypi-publish@release/v1 + # Pinned to an exact tag (rather than the moving release/v1) to lock + # down the action used for the actual PyPI upload via Trusted + # Publishing. + - uses: pypa/gh-action-pypi-publish@v1.10.3 diff --git a/.github/workflows/tox.yml b/.github/workflows/tox.yml index 51e5796..356a291 100644 --- a/.github/workflows/tox.yml +++ b/.github/workflows/tox.yml @@ -9,9 +9,9 @@ jobs: matrix: python-version: ["3.7", "3.8", "3.9", "3.10", "3.11"] steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@v4 - name: Set up Python ${{ matrix.python-version }} - uses: actions/setup-python@v3 + uses: actions/setup-python@v5 with: python-version: ${{ matrix.python-version }} - name: Install dependencies diff --git a/requirements.txt b/requirements.txt index c648cd2..b93e412 100644 --- a/requirements.txt +++ b/requirements.txt @@ -1 +1,4 @@ pbr>=1.4 +# Transitive build-time dep, pinned to fix CVE-2024-6345 (RCE in +# PackageIndex.download) and CVE-2025-47273 (path traversal in PackageIndex). +setuptools>=78.1.1 diff --git a/test-requirements.txt b/test-requirements.txt index 3858915..306a03e 100644 --- a/test-requirements.txt +++ b/test-requirements.txt @@ -1,3 +1,6 @@ -pytest>=2.7.2 -pylint>=1.7.1 -pytest-cov>=2.9 +pytest>=8.0.0 +pylint>=3.0.0 +pytest-cov>=5.0.0 +# Transitive (via importlib_metadata), pinned to fix CVE-2024-5569 +# (infinite-loop DoS in zipp.Path). +zipp>=3.19.1 From 797f84cea1ff925c23229398749faa8631169514 Mon Sep 17 00:00:00 2001 From: ahothan Date: Sun, 3 May 2026 09:02:48 -0700 Subject: [PATCH 2/4] Drop support for end-of-life Python versions As of May 2026, Python 3.6 (EOL 2021-12), 3.7 (EOL 2023-06), 3.8 (EOL 2024-10), and 3.9 (EOL 2025-10) no longer receive upstream security patches. Continuing to advertise support and ship wheels for those versions exposes downstream consumers to unpatched interpreter CVEs and forces this project to remain on aging, vulnerable transitive deps. Supported Python versions are now 3.10, 3.11, 3.12, and 3.13. Changes: * setup.cfg: add python_requires = >=3.10 so that pip on EOL interpreters refuses install with a clear error rather than pulling an incompatible wheel; classifiers reduced to 3.10-3.13. * tox.ini: envlist trimmed to py310, py311, py312, py313, lint. * .github/workflows/tox.yml: CI matrix trimmed to 3.10-3.13. * .github/workflows/python-publish.yml: explicit CIBW_BUILD="cp310-* cp311-* cp312-* cp313-*" so that cibuildwheel does not produce wheels for unsupported Pythons on release. This is a breaking change for users still on Python <3.10 and should be released as a new minor version (e.g. 0.11.0). Co-authored-by: Cursor --- .github/workflows/python-publish.yml | 5 +++++ .github/workflows/tox.yml | 2 +- setup.cfg | 7 +++---- tox.ini | 2 +- 4 files changed, 10 insertions(+), 6 deletions(-) diff --git a/.github/workflows/python-publish.yml b/.github/workflows/python-publish.yml index ccb449e..138e8f8 100644 --- a/.github/workflows/python-publish.yml +++ b/.github/workflows/python-publish.yml @@ -29,6 +29,11 @@ jobs: - name: Build wheels uses: pypa/cibuildwheel@v2.21.3 + env: + # Build wheels only for supported (non-EOL) CPython versions. + # Keep this list in sync with the python_requires in setup.cfg + # and the tox.yml test matrix. + CIBW_BUILD: "cp310-* cp311-* cp312-* cp313-*" - uses: actions/upload-artifact@v4 with: diff --git a/.github/workflows/tox.yml b/.github/workflows/tox.yml index 356a291..78bf2cf 100644 --- a/.github/workflows/tox.yml +++ b/.github/workflows/tox.yml @@ -7,7 +7,7 @@ jobs: runs-on: ubuntu-latest strategy: matrix: - python-version: ["3.7", "3.8", "3.9", "3.10", "3.11"] + python-version: ["3.10", "3.11", "3.12", "3.13"] steps: - uses: actions/checkout@v4 - name: Set up Python ${{ matrix.python-version }} diff --git a/setup.cfg b/setup.cfg index a27ebac..6d38956 100644 --- a/setup.cfg +++ b/setup.cfg @@ -6,6 +6,7 @@ description-file = author = Alec Hothan author-email = ahothan@gmail.com home-page = https://github.com/HdrHistogram/HdrHistogram_py +python_requires = >=3.10 classifier = Intended Audience :: Developers Intended Audience :: Information Technology @@ -15,12 +16,10 @@ classifier = Operating System :: MacOS Programming Language :: Python Programming Language :: Python :: 3 - Programming Language :: Python :: 3.6 - Programming Language :: Python :: 3.7 - Programming Language :: Python :: 3.8 - Programming Language :: Python :: 3.9 Programming Language :: Python :: 3.10 Programming Language :: Python :: 3.11 + Programming Language :: Python :: 3.12 + Programming Language :: Python :: 3.13 [files] packages = diff --git a/tox.ini b/tox.ini index 8fca6c2..547b773 100644 --- a/tox.ini +++ b/tox.ini @@ -1,5 +1,5 @@ [tox] -envlist = py36, py37, py38, py39, py310, py311, lint +envlist = py310, py311, py312, py313, lint [testenv:lint] commands = pylint --rcfile pylint.rc hdrh test From ff98528a0bc8fa8553d52afa0d07fad12a4a9546 Mon Sep 17 00:00:00 2001 From: ahothan Date: Sun, 3 May 2026 09:09:40 -0700 Subject: [PATCH 3/4] =?UTF-8?q?Add=20Python=203.14=20support;=20retire=203?= =?UTF-8?q?.6=E2=80=933.9=20EOL=20versions=20from=20docs?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Python 3.14 (released October 2025) is now a fully supported stable release. Add it to the tox envlist, CI test matrix, wheel build targets (CIBW_BUILD), and PyPI classifiers. Update README to list the supported versions explicitly (3.10–3.14) and replace stale Python 3.6.8 example output with current tooling versions. Co-authored-by: Cursor --- .github/workflows/python-publish.yml | 2 +- .github/workflows/tox.yml | 2 +- README.rst | 8 ++++---- setup.cfg | 1 + tox.ini | 2 +- 5 files changed, 8 insertions(+), 7 deletions(-) diff --git a/.github/workflows/python-publish.yml b/.github/workflows/python-publish.yml index 138e8f8..3b72c34 100644 --- a/.github/workflows/python-publish.yml +++ b/.github/workflows/python-publish.yml @@ -33,7 +33,7 @@ jobs: # Build wheels only for supported (non-EOL) CPython versions. # Keep this list in sync with the python_requires in setup.cfg # and the tox.yml test matrix. - CIBW_BUILD: "cp310-* cp311-* cp312-* cp313-*" + CIBW_BUILD: "cp310-* cp311-* cp312-* cp313-* cp314-*" - uses: actions/upload-artifact@v4 with: diff --git a/.github/workflows/tox.yml b/.github/workflows/tox.yml index 78bf2cf..58cff22 100644 --- a/.github/workflows/tox.yml +++ b/.github/workflows/tox.yml @@ -7,7 +7,7 @@ jobs: runs-on: ubuntu-latest strategy: matrix: - python-version: ["3.10", "3.11", "3.12", "3.13"] + python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"] steps: - uses: actions/checkout@v4 - name: Set up Python ${{ matrix.python-version }} diff --git a/README.rst b/README.rst index 7c8337c..e53be6a 100644 --- a/README.rst +++ b/README.rst @@ -26,7 +26,7 @@ library: - Text file histogram log writer and log reader (.hlog file) - Dump histogram in plot-friendly percentile table (.hgrm format) - Encoding and decoding Hdr Histogram "histoblobs" (HdrHistogram V2 format only, V1 and V0 not supported) -- supports python 3.x (0.9.2 is the latest release supporting python 2.7) +- supports Python 3.10, 3.11, 3.12, 3.13 and 3.14 (0.9.2 is the latest release supporting python 2.7) Histogram V2 format encoding inter-operability with Java and C versions verified through unit test code. @@ -128,7 +128,7 @@ Installation ------------ Pre-requisites: -Make sure you have python 3.x, and pip installed +Make sure you have Python 3.10 or later, and pip installed Binary installation ^^^^^^^^^^^^^^^^^^^ @@ -320,7 +320,7 @@ Example of run on Linux: # pytest -s -k test_cod_perf --runperf =============================================================================== test session starts ================================================================================ - platform linux -- Python 3.6.8, pytest-6.0.1, py-1.9.0, pluggy-0.13.1 + platform linux -- Python 3.13.3, pytest-8.3.5, pluggy-1.5.0 rootdir: /root/HdrHistogram_py, configfile: tox.ini collected 39 items / 38 deselected / 1 selected @@ -379,7 +379,7 @@ And for decoding: # pytest -s -k test_dec_perf --runperf =============================================================================== test session starts ================================================================================ - platform linux -- Python 3.6.8, pytest-6.0.1, py-1.9.0, pluggy-0.13.1 + platform linux -- Python 3.13.3, pytest-8.3.5, pluggy-1.5.0 rootdir: /root/HdrHistogram_py, configfile: tox.ini collected 39 items / 38 deselected / 1 selected diff --git a/setup.cfg b/setup.cfg index 6d38956..83e05f1 100644 --- a/setup.cfg +++ b/setup.cfg @@ -20,6 +20,7 @@ classifier = Programming Language :: Python :: 3.11 Programming Language :: Python :: 3.12 Programming Language :: Python :: 3.13 + Programming Language :: Python :: 3.14 [files] packages = diff --git a/tox.ini b/tox.ini index 547b773..f0b0cef 100644 --- a/tox.ini +++ b/tox.ini @@ -1,5 +1,5 @@ [tox] -envlist = py310, py311, py312, py313, lint +envlist = py310, py311, py312, py313, py314, lint [testenv:lint] commands = pylint --rcfile pylint.rc hdrh test From 5188864f89d6c77039aea0c4e100658e72fab6b0 Mon Sep 17 00:00:00 2001 From: ahothan Date: Sun, 3 May 2026 09:16:17 -0700 Subject: [PATCH 4/4] Fix pylint 3.x warnings in pylint.rc - overgeneral-exceptions: 'Exception' -> 'builtins.Exception' to satisfy the fully-qualified name requirement introduced in pylint 3.x. - Add max-positional-arguments=7 (new R0917 check in pylint 3.x, default is 5) to align with the existing max-args=12 policy; covers HdrHistogram.__init__ (7 positional incl. self) and check_zz_identity (6 positional). Co-authored-by: Cursor --- pylint.rc | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/pylint.rc b/pylint.rc index e5f0b06..7317055 100644 --- a/pylint.rc +++ b/pylint.rc @@ -321,6 +321,9 @@ valid-metaclass-classmethod-first-arg=mcs # Maximum number of arguments for function / method max-args=12 +# Maximum number of positional arguments for function / method (pylint 3.x) +max-positional-arguments=7 + # Maximum number of attributes for a class (see R0902). max-attributes=32 @@ -386,4 +389,4 @@ known-third-party=enchant # Exceptions that will emit a warning when being caught. Defaults to # "Exception" -overgeneral-exceptions=Exception +overgeneral-exceptions=builtins.Exception