CVE fix, use importlib.metadata instead of pkg_resources - #187
Open
Greglobrien wants to merge 2 commits into
Open
CVE fix, use importlib.metadata instead of pkg_resources#187Greglobrien wants to merge 2 commits into
Greglobrien wants to merge 2 commits into
Conversation
…e dep pkg_resources was removed in setuptools 82, which broke importing CyberSource.api_client (unguarded top-level import) and the runtime version lookup in get_client_id(). Switch to the stdlib importlib.metadata API (Python 3.8+), with a PackageNotFoundError guard that is more robust than the previous unguarded require() call. The change is applied to both the generated CyberSource/api_client.py and its source-of-truth generator template (generator/cybersource-python-template/api_client.mustache) so it survives SDK regeneration. pkg_resources was the only runtime consumer of setuptools, so setuptools is removed from install_requires (setup.py), requirements.txt, and requirements.mustache rather than merely unpinning it. Verified under setuptools 82.0.1: import succeeds, get_client_id() returns "cybs-rest-sdk-python-<version>", and the test suite is unchanged from the pre-existing baseline. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The Problem
The pinned setuptools version carries a known vulnerability (CVE-2026-59890, fixed in setuptools 83.0.0). On review, setuptools isn't actually needed at runtime — its only runtime consumer was
pkg_resourcesinCyberSource/api_client.py->get_client_id()but not beyond that.The Fix
Swap that lookup to the stdlib
importlib.metadataand drop setuptools frominstall_requires,requirements.txt, and template. On Python 3.8 and below the import falls back to theimportlib_metadatabackport.Applied to both the generated
CyberSource/api_client.pyand its generator template (.../api_client.mustache) so it survives updates.Verification
Test suite passed, no additional tests added.