Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

追加: 依存パッケージ脆弱性診断を導入し現パッケージに適用 #1151

Merged
merged 9 commits into from
Apr 9, 2024

Conversation

tarepan
Copy link
Contributor

@tarepan tarepan commented Mar 28, 2024

内容

概要: 依存パッケージ脆弱性診断を追加し、現時点での脆弱性を修正した。

依存パッケージ脆弱性診断は定期的に行う必要があり、そのためには ENGINE として定型の脆弱性診断が必要である。
よって safety を導入し、その利用法案内を CONTRIBUTING.md へ追記した。
これにより今後のコントリビュータが手動で容易に脆弱性診断をおこなえる。

また、この依存パッケージ脆弱性診断により、現時点での脆弱性を修正した。

関連 Issue

part of #728

定期診断 CI は #1152 にて導入予定

@tarepan tarepan requested a review from a team as a code owner March 28, 2024 18:13
@tarepan tarepan requested review from y-chan and removed request for a team March 28, 2024 18:13
Copy link

github-actions bot commented Mar 28, 2024

Coverage Result

Resultを開く
Name Stmts Miss Cover
run.py 517 197 coverage-62%
voicevox_engine/init.py 1 0 coverage-100%
voicevox_engine/cancellable_engine.py 97 75 coverage-23%
voicevox_engine/core/init.py 0 0 coverage-100%
voicevox_engine/core/core_adapter.py 81 6 coverage-93%
voicevox_engine/core/core_initializer.py 60 30 coverage-50%
voicevox_engine/core/core_wrapper.py 228 160 coverage-30%
voicevox_engine/dev/init.py 0 0 coverage-100%
voicevox_engine/dev/core/init.py 0 0 coverage-100%
voicevox_engine/dev/core/mock.py 65 2 coverage-97%
voicevox_engine/dev/tts_engine/init.py 0 0 coverage-100%
voicevox_engine/dev/tts_engine/mock.py 28 0 coverage-100%
voicevox_engine/engine_manifest/EngineManifest.py 36 0 coverage-100%
voicevox_engine/engine_manifest/EngineManifestLoader.py 11 0 coverage-100%
voicevox_engine/engine_manifest/init.py 0 0 coverage-100%
voicevox_engine/library_manager.py 92 4 coverage-96%
voicevox_engine/metas/Metas.py 36 0 coverage-100%
voicevox_engine/metas/MetasStore.py 28 1 coverage-96%
voicevox_engine/metas/init.py 0 0 coverage-100%
voicevox_engine/model.py 180 3 coverage-98%
voicevox_engine/morphing.py 72 4 coverage-94%
voicevox_engine/preset/Preset.py 13 0 coverage-100%
voicevox_engine/preset/PresetError.py 2 0 coverage-100%
voicevox_engine/preset/PresetManager.py 80 2 coverage-98%
voicevox_engine/preset/init.py 0 0 coverage-100%
voicevox_engine/setting/Setting.py 9 0 coverage-100%
voicevox_engine/setting/SettingLoader.py 20 0 coverage-100%
voicevox_engine/setting/init.py 0 0 coverage-100%
voicevox_engine/tts_pipeline/init.py 0 0 coverage-100%
voicevox_engine/tts_pipeline/kana_converter.py 88 1 coverage-99%
voicevox_engine/tts_pipeline/mora_mapping.py 7 0 coverage-100%
voicevox_engine/tts_pipeline/phoneme.py 34 0 coverage-100%
voicevox_engine/tts_pipeline/text_analyzer.py 146 6 coverage-96%
voicevox_engine/tts_pipeline/tts_engine.py 268 9 coverage-97%
voicevox_engine/user_dict/part_of_speech_data.py 5 0 coverage-100%
voicevox_engine/user_dict/user_dict.py 146 12 coverage-92%
voicevox_engine/utility/init.py 0 0 coverage-100%
voicevox_engine/utility/connect_base64_waves.py 37 0 coverage-100%
voicevox_engine/utility/core_utility.py 6 0 coverage-100%
voicevox_engine/utility/core_version_utility.py 8 1 coverage-88%
voicevox_engine/utility/mutex_utility.py 13 0 coverage-100%
voicevox_engine/utility/path_utility.py 26 6 coverage-77%
voicevox_engine/utility/run_utility.py 10 7 coverage-30%
TOTAL 2450 526 coverage-79%

@tarepan
Copy link
Contributor Author

tarepan commented Apr 7, 2024

@Hiroshiba
全指摘箇所の反映・テストパスを確認しました。Re-review よろしくお願いします。

Copy link
Member

@Hiroshiba Hiroshiba left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!!

なるほど、依存してるパッケージのバージョンが良くない時もあるんですね。
直接依存してるわけではないパッケージの更新方法の案内もあっても良いかもと思いました。
まあ、CIが入ったら…!

@Hiroshiba Hiroshiba merged commit 9a04a6d into VOICEVOX:master Apr 9, 2024
3 checks passed
@tarepan tarepan deleted the add/audit branch April 9, 2024 14:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants