Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(iast): bump sqlparse version #9043

Closed
wants to merge 1 commit into from
Closed

Conversation

gnufede
Copy link
Member

@gnufede gnufede commented Apr 19, 2024

Checklist

  • Change(s) are motivated and described in the PR description
  • Testing strategy is described if automated tests are not included in the PR
  • Risks are described (performance impact, potential for breakage, maintainability)
  • Change is maintainable (easy to change, telemetry, documentation)
  • Library release note guidelines are followed or label changelog/no-changelog is set
  • Documentation is included (in-code, generated user docs, public corp docs)
  • Backport labels are set (if applicable)
  • If this PR changes the public interface, I've notified @DataDog/apm-tees.

Reviewer Checklist

  • Title is accurate
  • All changes are related to the pull request's stated goal
  • Description motivates each change
  • Avoids breaking API changes
  • Testing strategy adequately addresses listed risks
  • Change is maintainable (easy to change, telemetry, documentation)
  • Release note makes sense to a user of the library
  • Author has acknowledged and discussed the performance implications of this PR as reported in the benchmarks PR comment
  • Backport labels are set in a manner that is consistent with the release branch maintenance policy

@pr-commenter
Copy link

pr-commenter bot commented Apr 19, 2024

Benchmarks

Benchmark execution time: 2024-04-19 08:41:44

Comparing candidate commit 513d4fe in PR branch gnufede/fix-bump-sqlparse with baseline commit 0bacde0 in branch main.

Found 1 performance improvements and 6 performance regressions! Performance is the same for 194 metrics, 9 unstable metrics.

scenario:flasksimple-appsec-telemetry

  • 🟩 execution_time [-261.004µs; -206.638µs] or [-4.000%; -3.167%]

scenario:httppropagationextract-all_styles_all_headers

  • 🟥 max_rss_usage [+593.343KB; +728.436KB] or [+2.804%; +3.443%]

scenario:httppropagationextract-wsgi_invalid_priority_header

  • 🟥 max_rss_usage [+526.073KB; +877.626KB] or [+2.483%; +4.141%]

scenario:httppropagationextract-wsgi_invalid_trace_id_header

  • 🟥 max_rss_usage [+886.347KB; +973.647KB] or [+4.237%; +4.654%]

scenario:httppropagationextract-wsgi_large_valid_headers_all

  • 🟥 max_rss_usage [+489.916KB; +851.524KB] or [+2.321%; +4.034%]

scenario:httppropagationextract-wsgi_medium_valid_headers_all

  • 🟥 max_rss_usage [+530.671KB; +841.899KB] or [+2.510%; +3.982%]

scenario:httppropagationinject-with_tags_max_size

  • 🟥 max_rss_usage [+712.718KB; +770.443KB] or [+3.372%; +3.645%]

@rorylogue
Copy link

How long until this is ready please? We're looking to bump this package to reduce our security vulnerabilities.

@taylorsweetman
Copy link

@Kyle-Verhoog, @brettlangdon, any chance this can be prioritized? This library is currently failing our organization's security scans due to a vulnerability in the current version of sqlparse

@enovanick
Copy link

Also waiting on the sqlparse version bump (our org restricts code releases which fail vuln scan).

@brettlangdon
Copy link
Member

We have merged #9212 which removes this dependency all together. Closing this PR since there is nothing to do until the other change is released.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

6 participants