temporal: Update and vendor ply dependency per repo's instructions as no longer published #5942
Conversation
…ved in newer version
github-actions
bot
added
windows
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| for n, s in enumerate(syms): | ||
| if s[0] in "'\"": | ||
| try: | ||
| c = eval(s) |
Check warning
Code scanning / Bandit
Use of possibly insecure function - consider using safer ast.literal_eval. Warning
|
PLY comes with ctypesgen (https://github.com/OSGeo/grass/tree/main/python/libgrass_interface_generator/ctypesgen/parser). Not sure if we should use that one instead… |
At the time, I didn't want to couple the ply version from ctypesgen into our runtime code. Its already hard enough to get ctypesgen updated, so I left their version alone, it works with their code. Ply, in the python grass.temporal code, is distributed at runtime. I think ctypesgen is meant to be a compile-time tool, and not really distributed. |
| for n, s in enumerate(syms): | ||
| if s[0] in "'\"": | ||
| try: | ||
| c = eval(s) |
Check warning
Code scanning / Bandit
Use of possibly insecure function - consider using safer ast.literal_eval.
Closes #5917
I updated my old branch that updated the ply dependency with a vendored copy, as per the author's instructions.
Tests still pass in CI, and it is also adjusted to be built with CMake. The dependency is removed from the various lists.