A HugSQL-inspired database library for Python

Dan McKinley

Last update: Dec 24, 2022

Related tags

Database Drivers pugsql

Overview

PugSQL

PugSQL is a simple Python interface for using parameterized SQL, in files.

See pugsql.org for the documentation.

To install:

pip install pugsql

Development Setup

To set up a development environment, create a virtual environment. pyenv-virtualenv is a good way to do this:

brew install pyenv-virtualenv
pyenv virtualenv 3.8.2 pugsql
pyenv activate pugsql

Development of the library is done with poetry. Install poetry to your virtualenv:

pip install --upgrade pip
pip install poetry

To run the tests and the linter:

poetry run pytest
poetry run flake8

Comments

Connecting to multiple DBs
Hi, thanks for writing PugSQL! I'm trying to use it for an ETL use case moving data from one db to another. I thought I'd try something like this:

source_db_queries = pugsql.module('pugsql_test_queries') source_db_queries.connect(source_db_url) dest_db_queries = pugsql.module('pugsql_test_queries') dest_db_queries .connect(dest_db_url)

But what seems to happen is the 'source_db_queries' instance gets connected to the destination db; I'd assume these would be separate due to the separate instances, despite reading from the same folder. I'm using "mysql+mysqlconnector" URLs, if that makes any difference.

It works fine when I organize queries into separate folders based on the db where they'll be run (which probably makes more sense anyway), but thought I'd highlight this unexpected behavior.
opened by evan-burke 5
Commit nested transactions when exiting the context

This change is required for PostgreSQL, I tested it with version 11.

Without a commit statement, nested transactions are silently rolled back, the behavior is quite surprising.

opened by o-fedorov 2
Improve errors when calling methods without keyword params
See discussion in issue: https://github.com/mcfunley/pugsql/issues/38

When calling a query method as:

queries.foo(1, 2)

Rather than:

queries.foo(a=1, b=2)

You get an unhelpful error. Ideally the exception text would tell you to use kwargs.
good first issue
opened by mcfunley 2

AttributeError: 'tuple' object has no attribute 'keys'

Trying to run following SQL statement cause this error:

AttributeError: 'tuple' object has no attribute 'keys'

SQL:

-- :name create_item :scalar
insert into item(title, type, user, status)
select :title, t.id, u.id, :status
    from user as u
    inner join item_type as t on u.user_name = :user and d.type = :type
RETURNING id

opened by Yeganloo 2

Support multiple query modules

When using pugsql in a separate python package would be useful to define multiple query modules so that users of that package can extend its functionality with new queries.

At the moment we define where our sql queries live like this: queries = pugsql.module("resources/sql")

My proposal is to be able to add other modules where queries can live: queries = pugsql.module("resources/sql") queries.add_module("other_resources/sql")

The add_module would do the work of concatenating all the resources in the existing modules. The main functionality for running queries would be exactly the same.

opened by filias 2
UTF-8 support?

Hi,

is there a way to specify utf8 encoding when connecting to the (sqlite) database? I have utf8 content in the database and it gets back mangled.

Cheers

opened by eabra 2

Update index.md

If the leading comment begins with three dashes as shown in the example, I get a ValueError: Statement must have a name. error.

Not sure how to fix it in the lexer so I just thought I'd update the docs and leave this as a note that there's "something up with it". :)

PugSQL Version: 0.1.9

Query file:

--- :name customer_total :one
SELECT
  COUNT(DISTINCT user_id) users
FROM
  transactions

Stack Trace:

Traceback (most recent call last):
  File "/usr/lib/python3.6/multiprocessing/process.py", line 258, in _bootstrap
    self.run()
  File "/usr/lib/python3.6/multiprocessing/process.py", line 93, in run
    self._target(*self._args, **self._kwargs)
  File "/home/daniel/.local/share/virtualenvs/myproject-bUWJ7r0D/lib/python3.6/site-packages/uvicorn/main.py", line 306, in run
    loop.run_until_complete(self.serve(sockets=sockets))
  File "uvloop/loop.pyx", line 1451, in uvloop.loop.Loop.run_until_complete
  File "/home/daniel/.local/share/virtualenvs/myproject-bUWJ7r0D/lib/python3.6/site-packages/uvicorn/main.py", line 313, in serve
    config.load()
  File "/home/daniel/.local/share/virtualenvs/myproject-bUWJ7r0D/lib/python3.6/site-packages/uvicorn/config.py", line 182, in load
    self.loaded_app = import_from_string(self.app)
  File "/home/daniel/.local/share/virtualenvs/myproject-bUWJ7r0D/lib/python3.6/site-packages/uvicorn/importer.py", line 20, in import_from_string
    module = importlib.import_module(module_str)
  File "/home/daniel/.local/share/virtualenvs/myproject-bUWJ7r0D/lib/python3.6/importlib/__init__.py", line 126, in import_module
    return _bootstrap._gcd_import(name[level:], package, level)
  File "<frozen importlib._bootstrap>", line 994, in _gcd_import
  File "<frozen importlib._bootstrap>", line 971, in _find_and_load
  File "<frozen importlib._bootstrap>", line 955, in _find_and_load_unlocked
  File "<frozen importlib._bootstrap>", line 665, in _load_unlocked
  File "<frozen importlib._bootstrap_external>", line 678, in exec_module
  File "<frozen importlib._bootstrap>", line 219, in _call_with_frames_removed
  File "./app.py", line 30, in <module>
    db = pugsql.module('queries/')
  File "/home/daniel/.local/share/virtualenvs/myproject-bUWJ7r0D/lib/python3.6/site-packages/pugsql/__init__.py", line 35, in module
    return compiler._module(sqlpath)
  File "/home/daniel/.local/share/virtualenvs/myproject-bUWJ7r0D/lib/python3.6/site-packages/pugsql/compiler.py", line 151, in _module
    modules[sqlpath] = Module(sqlpath)
  File "/home/daniel/.local/share/virtualenvs/myproject-bUWJ7r0D/lib/python3.6/site-packages/pugsql/compiler.py", line 45, in __init__
    s = parser.parse(pugsql, ctx=context.Context(sqlfile))
  File "/home/daniel/.local/share/virtualenvs/myproject-bUWJ7r0D/lib/python3.6/site-packages/pugsql/parser.py", line 38, in parse
    filename=ctx.sqlfile if ctx.sqlfile != '<literal>' else None)
  File "/home/daniel/.local/share/virtualenvs/myproject-bUWJ7r0D/lib/python3.6/site-packages/pugsql/statement.py", line 68, in __init__
    raise ValueError('Statement must have a name.')
ValueError: Statement must have a name.

opened by danielk-bud 2

fix for AttributeError when initialized in other thread
Bug report

I'm running pugsql.module() in flask's app.before_first_request, which I suspect means it runs in its own short-lived thread.

I get this traceback in the Module.transaction call (redacted):

File "**/auth.py", line **, in ** with **.queries.transaction(): File "/usr/lib/python3.6/contextlib.py", line 81, in __enter__ return next(self.gen) File "**/.direnv/python-3.6.7/lib/python3.6/site-packages/pugsql/compiler.py", line 83, in transaction if not self._locals.session: AttributeError: '_thread._local' object has no attribute 'session'

I think this is because self._locals.session gets initialized in the constructor i.e. only in one thread. I suspect that this would fail in the same way in any multithreaded program.

Fix

self._locals.session -> getattr(self._locals, 'session', None)
opened by abe-winter 2
Bump nokogiri from 1.13.3 to 1.13.6 in /docs
Bumps nokogiri from 1.13.3 to 1.13.6.

Release notes

Sourced from nokogiri's releases.

1.13.6 / 2022-05-08

Security

[CRuby] Address CVE-2022-29181, improper handling of unexpected data types, related to untrusted inputs to the SAX parsers. See GHSA-xh29-r2w5-wx8m for more information.

Improvements

{HTML4,XML}::SAX::{Parser,ParserContext} constructor methods now raise TypeError instead of segfaulting when an incorrect type is passed.

sha256:

58417c7c10f78cd1c0e1984f81538300d4ea98962cfd3f46f725efee48f9757a nokogiri-1.13.6-aarch64-linux.gem a2b04ec3b1b73ecc6fac619b41e9fdc70808b7a653b96ec97d04b7a23f158dbc nokogiri-1.13.6-arm64-darwin.gem 4437f2d03bc7da8854f4aaae89e24a98cf5c8b0212ae2bc003af7e65c7ee8e27 nokogiri-1.13.6-java.gem 99d3e212bbd5e80aa602a1f52d583e4f6e917ec594e6aa580f6aacc253eff984 nokogiri-1.13.6-x64-mingw-ucrt.gem a04f6154a75b6ed4fe2d0d0ff3ac02f094b54e150b50330448f834fa5726fbba nokogiri-1.13.6-x64-mingw32.gem a13f30c2863ef9e5e11240dd6d69ef114229d471018b44f2ff60bab28327de4d nokogiri-1.13.6-x86-linux.gem 63a2ca2f7a4f6bd9126e1695037f66c8eb72ed1e1740ef162b4480c57cc17dc6 nokogiri-1.13.6-x86-mingw32.gem 2b266e0eb18030763277b30dc3d64337f440191e2bd157027441ac56a59d9dfe nokogiri-1.13.6-x86_64-darwin.gem 3fa37b0c3b5744af45f9da3e4ae9cbd89480b35e12ae36b5e87a0452e0b38335 nokogiri-1.13.6-x86_64-linux.gem b1512fdc0aba446e1ee30de3e0671518eb363e75fab53486e99e8891d44b8587 nokogiri-1.13.6.gem

1.13.5 / 2022-05-04

Security

[CRuby] Vendored libxml2 is updated to address CVE-2022-29824. See GHSA-cgx6-hpwq-fhv5 for more information.

Dependencies

[CRuby] Vendored libxml2 is updated from v2.9.13 to v2.9.14.

Improvements

[CRuby] The libxml2 HTML4 parser no longer exhibits quadratic behavior when recovering some broken markup related to start-of-tag and bare < characters.

Changed

[CRuby] The libxml2 HTML4 parser in v2.9.14 recovers from some broken markup differently. Notably, the XML CDATA escape sequence <![CDATA[ and incorrectly-opened comments will result in HTML text nodes starting with <! instead of skipping the invalid tag. This behavior is a direct result of the quadratic-behavior fix noted above. The behavior of downstream sanitizers relying on this behavior will also change. Some tests describing the changed behavior are in test/html4/test_comments.rb.

... (truncated)

Changelog

Sourced from nokogiri's changelog.

1.13.6 / 2022-05-08

Security

[CRuby] Address CVE-2022-29181, improper handling of unexpected data types, related to untrusted inputs to the SAX parsers. See GHSA-xh29-r2w5-wx8m for more information.

Improvements

{HTML4,XML}::SAX::{Parser,ParserContext} constructor methods now raise TypeError instead of segfaulting when an incorrect type is passed.

1.13.5 / 2022-05-04

Security

[CRuby] Vendored libxml2 is updated to address CVE-2022-29824. See GHSA-cgx6-hpwq-fhv5 for more information.

Dependencies

[CRuby] Vendored libxml2 is updated from v2.9.13 to v2.9.14.

Improvements

[CRuby] The libxml2 HTML parser no longer exhibits quadratic behavior when recovering some broken markup related to start-of-tag and bare < characters.

Changed

[CRuby] The libxml2 HTML parser in v2.9.14 recovers from some broken markup differently. Notably, the XML CDATA escape sequence <![CDATA[ and incorrectly-opened comments will result in HTML text nodes starting with <! instead of skipping the invalid tag. This behavior is a direct result of the quadratic-behavior fix noted above. The behavior of downstream sanitizers relying on this behavior will also change. Some tests describing the changed behavior are in test/html4/test_comments.rb.

1.13.4 / 2022-04-11

Security

Address CVE-2022-24836, a regular expression denial-of-service vulnerability. See GHSA-crjr-9rc5-ghw8 for more information.

[CRuby] Vendored zlib is updated to address CVE-2018-25032. See GHSA-v6gp-9mmm-c6p5 for more information.

[JRuby] Vendored Xerces-J (xerces:xercesImpl) is updated to address CVE-2022-23437. See GHSA-xxx9-3xcr-gjj3 for more information.

[JRuby] Vendored nekohtml (org.cyberneko.html) is updated to address CVE-2022-24839. See GHSA-gx8x-g87m-h5q6 for more information.

Dependencies

[CRuby] Vendored zlib is updated from 1.2.11 to 1.2.12. (See LICENSE-DEPENDENCIES.md for details on which packages redistribute this library.)

[JRuby] Vendored Xerces-J (xerces:xercesImpl) is updated from 2.12.0 to 2.12.2.

[JRuby] Vendored nekohtml (org.cyberneko.html) is updated from a fork of 1.9.21 to 1.9.22.noko2. This fork is now publicly developed at https://github.com/sparklemotion/nekohtml

Commits

b7817b6 version bump to v1.13.6

61b1a39 Merge pull request #2530 from sparklemotion/flavorjones-check-parse-memory-ty...

83cc451 fix: {HTML4,XML}::SAX::{Parser,ParserContext} check arg types

22c9e5b version bump to v1.13.5

6155881 doc: update CHANGELOG for v1.13.5

c519a47 Merge pull request #2527 from sparklemotion/2525-update-libxml-2_9_14-v1_13_x

66c2886 dep: update libxml2 to v2.9.14

b7c4cc3 test: unpend the LIBXML_LOADED_VERSION test on freebsd

eac7934 dev: require yaml

f3521ba style(rubocop): pend Style/FetchEnvVar for now

Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot use these labels will set the current labels as the default for future PRs for this repo and language

@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language

@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language

@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

dependencies ruby
opened by dependabot[bot] 1
Bump nokogiri from 1.13.3 to 1.13.4 in /docs
Bumps nokogiri from 1.13.3 to 1.13.4.

Release notes

Sourced from nokogiri's releases.

1.13.4 / 2022-04-11

Security

Address CVE-2022-24836, a regular expression denial-of-service vulnerability. See GHSA-crjr-9rc5-ghw8 for more information.

[CRuby] Vendored zlib is updated to address CVE-2018-25032. See GHSA-v6gp-9mmm-c6p5 for more information.

[JRuby] Vendored Xerces-J (xerces:xercesImpl) is updated to address CVE-2022-23437. See GHSA-xxx9-3xcr-gjj3 for more information.

[JRuby] Vendored nekohtml (org.cyberneko.html) is updated to address CVE-2022-24839. See GHSA-gx8x-g87m-h5q6 for more information.

Dependencies

[CRuby] Vendored zlib is updated from 1.2.11 to 1.2.12. (See LICENSE-DEPENDENCIES.md for details on which packages redistribute this library.)

[JRuby] Vendored Xerces-J (xerces:xercesImpl) is updated from 2.12.0 to 2.12.2.

[JRuby] Vendored nekohtml (org.cyberneko.html) is updated from a fork of 1.9.21 to 1.9.22.noko2. This fork is now publicly developed at https://github.com/sparklemotion/nekohtml

sha256sum:

095ff1995ed3dda3ea98a5f08bdc54bef02be1ce4e7c81034c4812e5e7c6e7e3 nokogiri-1.13.4-aarch64-linux.gem 7ebfc7415c819bcd4e849627e879cef2fb328bec90e802e50d74ccd13a60ec75 nokogiri-1.13.4-arm64-darwin.gem 41efd87c121991de26ef0393ac713d687e539813c3b79e454a2e3ffeecd107ea nokogiri-1.13.4-java.gem ab547504692ada0cec9d2e4e15afab659677c3f4c1ac3ea639bf5212b65246a1 nokogiri-1.13.4-x64-mingw-ucrt.gem fa5c64cfdb71642ed647428e4d0d75ee0f4d189cfb63560c66fd8bdf99eb146b nokogiri-1.13.4-x64-mingw32.gem d6f07cbcbc28b75e8ac5d6e729ffba3602dffa0ad16ffac2322c9b4eb9b971fc nokogiri-1.13.4-x86-linux.gem 0f7a4fd13e25abe3f98663fef0d115d58fdeff62cf23fef12d368e42adad2ce6 nokogiri-1.13.4-x86-mingw32.gem 3eef282f00ad360304fbcd5d72eb1710ff41138efda9513bb49eec832db5fa3e nokogiri-1.13.4-x86_64-darwin.gem 3978610354ec67b59c128d23259c87b18374ee1f61cb9ed99de7143a88e70204 nokogiri-1.13.4-x86_64-linux.gem 0d46044eb39271e3360dae95ed6061ce17bc0028d475651dc48db393488c83bc nokogiri-1.13.4.gem

Changelog

Sourced from nokogiri's changelog.

1.13.4 / 2022-04-11

Security

Address CVE-2022-24836, a regular expression denial-of-service vulnerability. See GHSA-crjr-9rc5-ghw8 for more information.

[CRuby] Vendored zlib is updated to address CVE-2018-25032. See GHSA-v6gp-9mmm-c6p5 for more information.

[JRuby] Vendored Xerces-J (xerces:xercesImpl) is updated to address CVE-2022-23437. See GHSA-xxx9-3xcr-gjj3 for more information.

[JRuby] Vendored nekohtml (org.cyberneko.html) is updated to address CVE-2022-24839. See GHSA-gx8x-g87m-h5q6 for more information.

Dependencies

[CRuby] Vendored zlib is updated from 1.2.11 to 1.2.12. (See LICENSE-DEPENDENCIES.md for details on which packages redistribute this library.)

[JRuby] Vendored Xerces-J (xerces:xercesImpl) is updated from 2.12.0 to 2.12.2.

[JRuby] Vendored nekohtml (org.cyberneko.html) is updated from a fork of 1.9.21 to 1.9.22.noko2. This fork is now publicly developed at https://github.com/sparklemotion/nekohtml

Commits

4e2c4b2 version bump to v1.13.4

6a20ee4 Merge pull request #2510 from sparklemotion/flavorjones-encoding-reader-perfo...

b848031 Merge pull request #2509 from sparklemotion/flavorjones-parse-processing-inst...

c0ecf3b test: pend the LIBXML_LOADED_VERSION test on freebsd

e444525 fix(perf): HTML4::EncodingReader detection

1eb5580 style(rubocop): allow intentional use of empty initializer

0feac5a fix(dep): HTML parsing of processing instructions

db72b90 test: recent nekohtml versions do not consider 'a' to be inline

2af2a87 style(rubocop): allow intentional use of empty initializer

ba7a28c Merge pull request #2499 from sparklemotion/2441-xerces-2.12.2-backport-v1.13.x

Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot use these labels will set the current labels as the default for future PRs for this repo and language

@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language

@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language

@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

dependencies ruby
opened by dependabot[bot] 1
Bump py from 1.9.0 to 1.10.0
Bumps py from 1.9.0 to 1.10.0.

Changelog

Sourced from py's changelog.

1.10.0 (2020-12-12)

Fix a regular expression DoS vulnerability in the py.path.svnwc SVN blame functionality (CVE-2020-29651)

Update vendored apipkg: 1.4 => 1.5

Update vendored iniconfig: 1.0.0 => 1.1.1

Commits

e5ff378 Update CHANGELOG for 1.10.0

94cf44f Update vendored libs

5e8ded5 testing: comment out an assert which fails on Python 3.9 for now

afdffcc Rename HOWTORELEASE.rst to RELEASING.rst

2de53a6 Merge pull request #266 from nicoddemus/gh-actions

fa1b32e Merge pull request #264 from hugovk/patch-2

887d6b8 Skip test_samefile_symlink on pypy3 on Windows

e94e670 Fix test_comments() in test_source

fef9a32 Adapt test

4a694b0 Add GitHub Actions badge to README

Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot use these labels will set the current labels as the default for future PRs for this repo and language

@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language

@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language

@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

dependencies python
opened by dependabot[bot] 1
Bump nokogiri from 1.13.3 to 1.13.9 in /docs
Bumps nokogiri from 1.13.3 to 1.13.9.

Release notes

Sourced from nokogiri's releases.

1.13.9 / 2022-10-18

Security

[CRuby] Vendored libxml2 is updated to address CVE-2022-2309, CVE-2022-40304, and CVE-2022-40303. See GHSA-2qc6-mcvw-92cw for more information.

[CRuby] Vendored zlib is updated to address CVE-2022-37434. Nokogiri was not affected by this vulnerability, but this version of zlib was being flagged up by some vulnerability scanners, see #2626 for more information.

Dependencies

[CRuby] Vendored libxml2 is updated to v2.10.3 from v2.9.14.

[CRuby] Vendored libxslt is updated to v1.1.37 from v1.1.35.

[CRuby] Vendored zlib is updated from 1.2.12 to 1.2.13. (See LICENSE-DEPENDENCIES.md for details on which packages redistribute this library.)

Fixed

[CRuby] Nokogiri::XML::Namespace objects, when compacted, update their internal struct's reference to the Ruby object wrapper. Previously, with GC compaction enabled, a segmentation fault was possible after compaction was triggered. [#2658] (Thanks, @eightbitraptor and @peterzhu2118!)

[CRuby] Document#remove_namespaces! now defers freeing the underlying xmlNs struct until the Document is GCed. Previously, maintaining a reference to a Namespace object that was removed in this way could lead to a segfault. [#2658]

sha256 checksums:

9b69829561d30c4461ea803baeaf3460e8b145cff7a26ce397119577a4083a02 nokogiri-1.13.9-aarch64-linux.gem e76ebb4b7b2e02c72b2d1541289f8b0679fb5984867cf199d89b8ef485764956 nokogiri-1.13.9-arm64-darwin.gem 15bae7d08bddeaa898d8e3f558723300137c26a2dc2632a1f89c8574c4467165 nokogiri-1.13.9-java.gem f6a1dbc7229184357f3129503530af73cc59ceba4932c700a458a561edbe04b9 nokogiri-1.13.9-x64-mingw-ucrt.gem 36d935d799baa4dc488024f71881ff0bc8b172cecdfc54781169c40ec02cbdb3 nokogiri-1.13.9-x64-mingw32.gem ebaf82aa9a11b8fafb67873d19ee48efb565040f04c898cdce8ca0cd53ff1a12 nokogiri-1.13.9-x86-linux.gem 11789a2a11b28bc028ee111f23311461104d8c4468d5b901ab7536b282504154 nokogiri-1.13.9-x86-mingw32.gem 01830e1646803ff91c0fe94bc768ff40082c6de8cfa563dafd01b3f7d5f9d795 nokogiri-1.13.9-x86_64-darwin.gem 8e93b8adec22958013799c8690d81c2cdf8a90b6f6e8150ab22e11895844d781 nokogiri-1.13.9-x86_64-linux.gem 96f37c1baf0234d3ae54c2c89aef7220d4a8a1b03d2675ff7723565b0a095531 nokogiri-1.13.9.gem

1.13.8 / 2022-07-23

Deprecated

XML::Reader#attribute_nodes is deprecated due to incompatibility between libxml2's xmlReader memory semantics and Ruby's garbage collector. Although this method continues to exist for backwards compatibility, it is unsafe to call and may segfault. This method will be removed in a future version of Nokogiri, and callers should use #attribute_hash instead. [#2598]

Improvements

XML::Reader#attribute_hash is a new method to safely retrieve the attributes of a node from XML::Reader. [#2598, #2599]

Fixed

... (truncated)

Changelog

Sourced from nokogiri's changelog.

1.13.9 / 2022-10-18

Security

[CRuby] Vendored libxml2 is updated to address CVE-2022-2309, CVE-2022-40304, and CVE-2022-40303. See GHSA-2qc6-mcvw-92cw for more information.

[CRuby] Vendored zlib is updated to address CVE-2022-37434. Nokogiri was not affected by this vulnerability, but this version of zlib was being flagged up by some vulnerability scanners, see #2626 for more information.

Dependencies

[CRuby] Vendored libxml2 is updated to v2.10.3 from v2.9.14.

[CRuby] Vendored libxslt is updated to v1.1.37 from v1.1.35.

[CRuby] Vendored zlib is updated from 1.2.12 to 1.2.13. (See LICENSE-DEPENDENCIES.md for details on which packages redistribute this library.)

Fixed

[CRuby] Nokogiri::XML::Namespace objects, when compacted, update their internal struct's reference to the Ruby object wrapper. Previously, with GC compaction enabled, a segmentation fault was possible after compaction was triggered. [#2658] (Thanks, @eightbitraptor and @peterzhu2118!)

[CRuby] Document#remove_namespaces! now defers freeing the underlying xmlNs struct until the Document is GCed. Previously, maintaining a reference to a Namespace object that was removed in this way could lead to a segfault. [#2658]

1.13.8 / 2022-07-23

Deprecated

XML::Reader#attribute_nodes is deprecated due to incompatibility between libxml2's xmlReader memory semantics and Ruby's garbage collector. Although this method continues to exist for backwards compatibility, it is unsafe to call and may segfault. This method will be removed in a future version of Nokogiri, and callers should use #attribute_hash instead. [#2598]

Improvements

XML::Reader#attribute_hash is a new method to safely retrieve the attributes of a node from XML::Reader. [#2598, #2599]

Fixed

[CRuby] Calling XML::Reader#attributes is now safe to call. In Nokogiri <= 1.13.7 this method may segfault. [#2598, #2599]

1.13.7 / 2022-07-12

Fixed

XML::Node objects, when compacted, update their internal struct's reference to the Ruby object wrapper. Previously, with GC compaction enabled, a segmentation fault was possible after compaction was triggered. [#2578] (Thanks, @eightbitraptor!)

1.13.6 / 2022-05-08

Security

[CRuby] Address CVE-2022-29181, improper handling of unexpected data types, related to untrusted inputs to the SAX parsers. See GHSA-xh29-r2w5-wx8m for more information.

... (truncated)

Commits

897759c version bump to v1.13.9

aeb1ac3 doc: update CHANGELOG

c663e49 Merge pull request #2671 from sparklemotion/flavorjones-update-zlib-1.2.13_v1...

212e07d ext: hack to cross-compile zlib v1.2.13 on darwin

76dbc8c dep: update zlib to v1.2.13

24e3a9c doc: update CHANGELOG

4db3b4d Merge pull request #2668 from sparklemotion/flavorjones-namespace-scopes-comp...

73d73d6 fix: Document#remove_namespaces! use-after-free bug

5f58b34 fix: namespace nodes behave properly when compacted

b08a858 test: repro namespace_scopes compaction issue

Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot use these labels will set the current labels as the default for future PRs for this repo and language

@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language

@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language

@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

dependencies ruby
opened by dependabot[bot] 0
Bump mako from 1.2.0 to 1.2.2
Bumps mako from 1.2.0 to 1.2.2.

Release notes

Sourced from mako's releases.

1.2.2

Released: Mon Aug 29 2022

bug

[bug] [lexer] Fixed issue in lexer where the regexp used to match tags would not correctly interpret quoted sections individually. While this parsing issue still produced the same expected tag structure later on, the mis-handling of quoted sections was also subject to a regexp crash if a tag had a large number of quotes within its quoted sections.

References: #366

1.2.1

Released: Thu Jun 30 2022

bug

[bug] [tests] Various fixes to the test suite in the area of exception message rendering to accommodate for variability in Python versions as well as Pygments.

References: #360

misc

[performance] Optimized some codepaths within the lexer/Python code generation process, improving performance for generation of templates prior to their being cached. Pull request courtesy Takuto Ikuta.

References: #361

Commits

See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot use these labels will set the current labels as the default for future PRs for this repo and language

@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language

@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language

@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

dependencies python
opened by dependabot[bot] 0
Bump tzinfo from 1.2.7 to 1.2.10 in /docs
Bumps tzinfo from 1.2.7 to 1.2.10.

Release notes

Sourced from tzinfo's releases.

v1.2.10

Fixed a relative path traversal bug that could cause arbitrary files to be loaded with require when used with RubyDataSource. Please refer to https://github.com/tzinfo/tzinfo/security/advisories/GHSA-5cm2-9h8c-rvfx for details. CVE-2022-31163.

Ignore the SECURITY file from Arch Linux's tzdata package. #134.

TZInfo v1.2.10 on RubyGems.org

v1.2.9

Fixed an incorrect InvalidTimezoneIdentifier exception raised when loading a zoneinfo file that includes rules specifying an additional transition to the final defined offset (for example, Africa/Casablanca in version 2018e of the Time Zone Database). #123.

TZInfo v1.2.9 on RubyGems.org

v1.2.8

Added support for handling "slim" format zoneinfo files that are produced by default by zic version 2020b and later. The POSIX-style TZ string is now used calculate DST transition times after the final defined transition in the file. The 64-bit section is now always used regardless of whether Time has support for 64-bit times. #120.

Rubinius is no longer supported.

TZInfo v1.2.8 on RubyGems.org

Changelog

Sourced from tzinfo's changelog.

Version 1.2.10 - 19-Jul-2022

Fixed a relative path traversal bug that could cause arbitrary files to be loaded with require when used with RubyDataSource. Please refer to https://github.com/tzinfo/tzinfo/security/advisories/GHSA-5cm2-9h8c-rvfx for details. CVE-2022-31163.

Ignore the SECURITY file from Arch Linux's tzdata package. #134.

Version 1.2.9 - 16-Dec-2020

Fixed an incorrect InvalidTimezoneIdentifier exception raised when loading a zoneinfo file that includes rules specifying an additional transition to the final defined offset (for example, Africa/Casablanca in version 2018e of the Time Zone Database). #123.

Version 1.2.8 - 8-Nov-2020

Added support for handling "slim" format zoneinfo files that are produced by default by zic version 2020b and later. The POSIX-style TZ string is now used calculate DST transition times after the final defined transition in the file. The 64-bit section is now always used regardless of whether Time has support for 64-bit times. #120.

Rubinius is no longer supported.

Commits

0814dcd Fix the release date.

fd05e2a Preparing v1.2.10.

b98c32e Merge branch 'fix-directory-traversal-1.2' into 1.2

ac3ee68 Remove unnecessary escaping of + within regex character classes.

9d49bf9 Fix relative path loading tests.

394c381 Remove private_constant for consistency and compatibility.

5e9f990 Exclude Arch Linux's SECURITY file from the time zone index.

17fc9e1 Workaround for 'Permission denied - NUL' errors with JRuby on Windows.

6bd7a51 Update copyright years.

9905ca9 Fix directory traversal in Timezone.get when using Ruby data source

Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot use these labels will set the current labels as the default for future PRs for this repo and language

@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language

@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language

@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

dependencies ruby
opened by dependabot[bot] 0
Need help - how pugsql is different from aiosql?

I would like to understand how pugsql is different from aiosql https://nackjicholson.github.io/aiosql/. I've used aiosql in the past where I needed to create a dashboard web application. I've used aiosql with fastapi. I appreciate any help in understanding.

opened by abbazs 0
Pugsql chokes on normal comments interspersed in the sql file

pugsql raises the following error if there are any normal comments in the sql code (unless they are between the :name special comment and the actual sql query. ValueError: Statement must have a name.

Is this the correct behaviour? Would it not be desirable to be able to comment out sections of the sql file or add section comments etc?

opened by ou-vlakvark 5
Using INSERT RETURNING seems to break sqlite3
I'm trying to write an INSERT RETURNING query which works on both Postgres and SQLite:

-- :name test_insert :insert INSERT INTO table (foo) VALUES (:bar) RETURNING id;

This causes a sqlalchemy.exc.OperationalError: (sqlite3.OperationalError) cannot commit transaction - SQL statements in progress error.

It's possible this is related to https://github.com/sqlalchemy/sqlalchemy/issues/6195
opened by ghallberg 2