Bump python versions to address CVE

.github/workflows/build-cross-action.yml

@@ -19,8 +19,8 @@ jobs:
       fail-fast: false
       matrix:
         version:
-          - 3.10.12
-          - 3.11.4
+          - 3.10.13
+          - 3.11.5
         host:
           - x86_64
           - aarch64
@@ -115,8 +115,8 @@ jobs:
       fail-fast: false
       matrix:
         version:
-          - 3.10.12
-          - 3.11.4
+          - 3.10.13
+          - 3.11.5
         arch:
           - x86_64
 
@@ -169,8 +169,8 @@ jobs:
       fail-fast: false
       matrix:
         version:
-          - 3.10.12
-          - 3.11.4
+          - 3.10.13
+          - 3.11.5
         arch:
           - amd64
           - x86

.github/workflows/build-native-action.yml

@@ -16,8 +16,8 @@ jobs:
       fail-fast: false
       matrix:
         version:
-          - 3.10.12
-          - 3.11.4
+          - 3.10.13
+          - 3.11.5
         host:
           - x86_64
           - aarch64
@@ -97,8 +97,8 @@ jobs:
       fail-fast: false
       matrix:
         version:
-          - 3.10.12
-          - 3.11.4
+          - 3.10.13
+          - 3.11.5
         arch:
           - x86_64
 
@@ -151,8 +151,8 @@ jobs:
       fail-fast: false
       matrix:
         version:
-          - 3.10.12
-          - 3.11.4
+          - 3.10.13
+          - 3.11.5
         arch:
           - amd64
           - x86
@@ -174,13 +174,13 @@ jobs:
       - name: Fetch Native Build
         if: ${{ matrix.arch != 'amd64' }}
         env:
-          RELENV_FETCH_VERSION: latest
+          RELENV_FETCH_VERSION: 0.13.4
         run: |
-          python3 -m relenv fetch --python=3.10.11
+          python3 -m relenv fetch --python=3.10.12
 
       - name: Build Python with Relenv
         env:
-          RELENV_NATIVE_PY_VERSION: 3.10.11
+          RELENV_NATIVE_PY_VERSION: 3.10.12
         run: |
           python -m relenv build --arch=${{ matrix.arch }} --python=${{ matrix.version }}
 

CHANGELOG.md

@@ -1,3 +1,8 @@
+0.13.5
+======
+* Bump to Python 3.10.13 and 3.11.5 due to CVE-2023-40217 and CVE-2023-41105
+
+
 0.13.4
 ======
 

relenv/build/darwin.py

@@ -72,7 +72,7 @@ def build_python(env, dirs, logfp):
     runcmd(["make", "install"], env=env, stderr=logfp, stdout=logfp)
 
 
-build = builds.add("darwin", populate_env=populate_env, version="3.10.12")
+build = builds.add("darwin", populate_env=populate_env, version="3.10.13")
 
 build.add(
     "openssl",
@@ -116,7 +116,7 @@ def build_python(env, dirs, logfp):
     download={
         "url": "https://www.python.org/ftp/python/{version}/Python-{version}.tar.xz",
         "fallback_url": "https://woz.io/relenv/dependencies/Python-{version}.tar.gz",
-        "md5sum": "49b0342476b984e106d308c25d657f12",
+        "md5sum": "8847dc6458d1431d0ae0f55942deeb89",
         "version": build.version,
     },
 )
@@ -130,5 +130,5 @@ def build_python(env, dirs, logfp):
     ],
 )
 
-build = build.copy(version="3.11.4", md5sum="fb7f7eae520285788449d569e45b6718")
+build = build.copy(version="3.11.5", md5sum="8847dc6458d1431d0ae0f55942deeb89")
 builds.add("darwin", builder=build)

relenv/build/linux.py

@@ -385,7 +385,7 @@ def build_python(env, dirs, logfp):
     # runcmd([str(python), "-m", "ensurepip", "-U"], env=env, stderr=logfp, stdout=logfp)
 
 
-build = builds.add("linux", populate_env=populate_env, version="3.10.12")
+build = builds.add("linux", populate_env=populate_env, version="3.10.13")
 
 build.add(
     "openssl",
@@ -570,7 +570,7 @@ def build_python(env, dirs, logfp):
         "url": "https://www.python.org/ftp/python/{version}/Python-{version}.tar.xz",
         "fallback_url": "https://woz.io/relenv/dependencies/Python-{version}.tar.xz",
         "version": build.version,
-        "md5sum": "49b0342476b984e106d308c25d657f12",
+        "md5sum": "8847dc6458d1431d0ae0f55942deeb89",
         "checkfunc": python_version,
         "checkurl": "https://www.python.org/ftp/python/",
     },
@@ -585,5 +585,5 @@ def build_python(env, dirs, logfp):
     ],
 )
 
-build = build.copy(version="3.11.4", md5sum="fb7f7eae520285788449d569e45b6718")
+build = build.copy(version="3.11.5", md5sum="8847dc6458d1431d0ae0f55942deeb89")
 builds.add("linux", builder=build)

relenv/build/windows.py

@@ -126,15 +126,15 @@ def build_python(env, dirs, logfp):
     )
 
 
-build = builds.add("win32", populate_env=populate_env, version="3.10.12")
+build = builds.add("win32", populate_env=populate_env, version="3.10.13")
 
 build.add(
     "python",
     build_func=build_python,
     download={
         "url": "https://www.python.org/ftp/python/{version}/Python-{version}.tar.xz",
         "version": build.version,
-        "md5sum": "49b0342476b984e106d308c25d657f12",
+        "md5sum": "8847dc6458d1431d0ae0f55942deeb89",
     },
 )
 
@@ -207,5 +207,5 @@ def runpip(pkg):
     wait_on=["python"],
 )
 
-build = build.copy(version="3.11.4", md5sum="fb7f7eae520285788449d569e45b6718")
+build = build.copy(version="3.11.5", md5sum="8847dc6458d1431d0ae0f55942deeb89")
 builds.add("win32", builder=build)

tests/test_verify_build.py

@@ -11,6 +11,7 @@
 import sys
 import textwrap
 
+import packaging
 import pytest
 
 from relenv.common import DATA_DIR, get_triplet, list_archived_builds, plat_from_triplet
@@ -173,7 +174,10 @@ def test_pip_install_salt_git(pipexec, build, tmp_path, pyexec):
 @pytest.mark.skip_on_darwin
 @pytest.mark.skip_on_windows
 @pytest.mark.skipif(
-    get_build_version() == "3.11.4", reason="3.11.4 will not work with 3005.x"
+    get_build_version()
+    and packaging.version.parse(get_build_version())
+    >= packaging.version.parse("3.11.4"),
+    reason="3.11.4 will not work with 3005.x",
 )
 def test_pip_install_salt(pipexec, build, tmp_path, pyexec):
     packages = [