robusta-api 0.45.0__tar.gz → 0.46.0__tar.gz

{robusta_api-0.45.0 → robusta_api-0.46.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: robusta-api
-Version: 0.45.0
+Version: 0.46.0
 Summary: 
 Author: Arik Alon
 Author-email: arikalon1@users.noreply.github.com
@@ -18,9 +18,10 @@ Requires-Dist: bitmath (>=1.3.3.1,<2.0.0.0)
 Requires-Dist: boto3 (>=1.42.19,<2.0.0)
 Requires-Dist: botocore (>=1.42.19,<2.0.0)
 Requires-Dist: certifi (>=2026.4.22)
+Requires-Dist: click (>=8.3.3)
 Requires-Dist: colorlog (>=5.0.1,<6.0.0)
 Requires-Dist: croniter (>=1.3.15,<2.0.0)
-Requires-Dist: cryptography (>=46.0.7,<47.0.0)
+Requires-Dist: cryptography (>=48.0.1,<49.0.0)
 Requires-Dist: datadog-api-client (>=1.2.0,<2.0.0) ; extra == "all"
 Requires-Dist: docutils (==0.19)
 Requires-Dist: dpath (>=2.0.5,<3.0.0)
@@ -31,23 +32,25 @@ Requires-Dist: h2 (>=4.3.0,<5.0.0)
 Requires-Dist: hikaru-model-26 (>=1.1.1,<2.0.0)
 Requires-Dist: httpx (==0.27.2)
 Requires-Dist: humanize (>=3.13.1,<4.0.0)
-Requires-Dist: idna (>=3.7)
+Requires-Dist: idna (>=3.15)
 Requires-Dist: jinja2 (>=3.1.5)
-Requires-Dist: kafka-python (>=2.0.2,<3.0.0) ; extra == "all"
+Requires-Dist: kafka-python (>=2.3.2,<3.0.0) ; extra == "all"
 Requires-Dist: kubernetes (>=26.1.0,<27.0.0)
 Requires-Dist: markdown2 (==2.4.13)
 Requires-Dist: opsgenie-sdk (>=2.1.5,<3.0.0)
+Requires-Dist: pillow (>=12.3.0,<13.0.0)
 Requires-Dist: poetry-core (==1.1.0a7) ; extra == "all"
 Requires-Dist: postgrest (==0.16.8)
 Requires-Dist: prometheus-api-client (==0.5.4) ; extra == "all"
 Requires-Dist: prometheus-client (>=0.12.0,<0.13.0)
 Requires-Dist: prometrix (==0.2.11)
-Requires-Dist: pyasn1 (>=0.6.3)
+Requires-Dist: pyasn1 (>=0.6.4)
 Requires-Dist: pydantic (>=1.8.1,<2.0.0)
 Requires-Dist: pydash (==8.0.0)
 Requires-Dist: pygal (>=3.0.0,<4.0.0)
-Requires-Dist: pyjwt (>=2.12.0,<3.0.0)
+Requires-Dist: pyjwt (>=2.13.0,<3.0.0)
 Requires-Dist: pymsteams (>=0.1.16,<0.2.0)
+Requires-Dist: python-json-logger (>=3.0.0,<4.0.0)
 Requires-Dist: pytz (>=2021.3,<2022.0)
 Requires-Dist: pyyaml (>=6.0,<7.0)
 Requires-Dist: regex (==2024.5.15)

{robusta_api-0.45.0 → robusta_api-0.46.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "robusta-api"
-version = "0.45.0"
+version = "0.46.0"
 description = ""
 authors = ["Arik Alon <arikalon1@users.noreply.github.com>"]
 packages = [
@@ -20,10 +20,13 @@ include_trailing_comma = true
 python = ">=3.10, <3.12"
 setuptools = "^80.9.0"
 colorlog = "^5.0.1"
+python-json-logger = "^3.0.0"
 pydantic = "^1.8.1"
 kubernetes = "^26.1.0"
 pymsteams = "^0.1.16"
-idna= { version = ">=3.7", optional = true }
+# Bump to fix CVE-2026-45409 / GHSA-65pc-fj4g-8rjx (Moderate, GHSA published
+# 2026-05-19, older than 60 days): idna.encode() bypass of the CVE-2024-3651 fix
+idna= { version = ">=3.15", optional = true }
 supabase = "2.5.1"
 tabulate = { version = "^0.8.10" }
 slack-sdk = { version = "^3.23.0" }
@@ -34,7 +37,8 @@ grafana-api = { version = "^1.0.3", optional = true }
 watchdog =  { version = "^2.1.0", optional = true }
 better-exceptions = { version =  "^0.3.3", optional = true }
 CairoSVG = { version = "^2.5.2", optional = true }
-kafka-python = { version = "^2.0.2", optional = true }
+# Bump to fix CVE-2026-10142, CVE-2026-10143 (High): kafka-python protocol-parser DoS
+kafka-python = { version = "^2.3.2", optional = true }
 datadog-api-client = { version = "^1.2.0", optional = true }
 dpath = "^2.0.5"
 websocket-client = "1.3.3"
@@ -57,7 +61,8 @@ humanize = "^3.13.1"
 # and therefore requires gcc to install which we'd like to avoid
 # this is similar to the issue at https://github.com/dulwich/dulwich/issues/839
 # Pin to fix CVE-2026-39892 (Critical): cryptography buffer overflow with non-contiguous buffers
-cryptography = "^46.0.7"
+# Pin to fix GHSA-537c-gmf6-5ccf (High): cryptography
+cryptography = "^48.0.1"
 fpdf2 = "^2.7.1"
 attrs = "^23.1.0"
 prometrix = "0.2.11"
@@ -73,24 +78,34 @@ requests = "^2.33.0"
 # Bump to fix certifi CVE flagged by customer scan; date-versioned, so use >= rather than caret
 certifi = ">=2026.4.22"
 regex = "2024.5.15"
-pyjwt = "^2.12.0"
+# Pin to fix CVE-2026-48526 (High) + CVE-2026-48522/48523/48525 (Medium): PyJWT
+pyjwt = "^2.13.0"
 urllib3 = "^2.7.0"
 httpx = "0.27.2"
 postgrest = "0.16.8"
 # Pin to fix cve https://github.com/robusta-dev/robusta/security/dependabot/85
 h2 = "^4.3.0"
 # Pin to fix CVE-2026-30922 (transitive via google-auth)
-pyasn1 = ">=0.6.3"
+# Bump to fix CVE-2026-59885, CVE-2026-59886 (High)
+pyasn1 = ">=0.6.4"
 # Pin to fix CVE-2026-22701 (transitive via virtualenv/pre-commit)
 filelock = ">=3.20.3"
 # Pin to fix CVE-2026-22702 (transitive via pre-commit)
 virtualenv = "^20.36.1"
+# Pillow is pulled in transitively (fpdf2, CairoSVG). Pin to fix CVE-2026-54058,
+# CVE-2026-54059, CVE-2026-54060, CVE-2026-55379, CVE-2026-55380, CVE-2026-59197,
+# CVE-2026-59199, CVE-2026-59200, CVE-2026-59204, CVE-2026-59205 (High)
+pillow = "^12.3.0"
+# click is pulled in transitively (flask, typer). Pin to fix CVE-2026-7246 (High):
+# command injection via unsanitized filename in click.edit()
+click = ">=8.3.3"
 
 [tool.poetry.dev-dependencies]
 pre-commit = "^2.13.0"
 # Pin to fix CVE-2025-71176 (pytest < 9.0.3)
 pytest = "^9.0.3"
-python-dotenv = "^0.18.0"
+# Bump to fix CVE-2026-28684 (Medium, published 2026-04-20)
+python-dotenv = "^1.2.2"
 Sphinx = "6.2.1"
 #furo = "^2021.11.12"
 sphinx-autobuild = "^2021.3.14"
@@ -100,7 +115,6 @@ witchhazel = "^2018.8.23"
 sphinx-autodoc-typehints = "^1.12.0"
 sphinxcontrib-images = "^0.9.4"
 jsonref = "^0.2"
-Pillow = "^12.2.0"
 sphinxcontrib-mermaid = "^0.7.1"
 cssselect = "^1.1.0"
 tinycss = "^0.4"
@@ -130,7 +144,8 @@ all = ["Flask", "grafana-api", "watchdog", "better-exceptions", "CairoSVG", "tab
 sphinx-jinja = { git = "https://github.com/robusta-dev/sphinx-jinja.git" }
 sphinx-reredirects = "^0.1.1"
 freezegun = "^1.4.0"
-tornado = "^6.5.5"
+# Bump to fix CVE-2026-49853, CVE-2026-49855 (High) and GHSA-pw6j-qg29-8w7f (Medium)
+tornado = "^6.5.7"
 responses = "^0.25.7"
 
 [build-system]

{robusta_api-0.45.0 → robusta_api-0.46.0}/src/robusta/_version.py

@@ -1,2 +1,2 @@
 # this is updated by .github/workflows/release.yaml
-__version__ = "0.45.0"
+__version__ = "0.46.0"

{robusta_api-0.45.0 → robusta_api-0.46.0}/src/robusta/core/model/env_vars.py

@@ -104,6 +104,10 @@ DISABLE_FINDINGS_PERSISTENCE = load_bool("DISABLE_FINDINGS_PERSISTENCE", False)
 DISABLE_DISCOVERY = load_bool("DISABLE_DISCOVERY", False)
 DISABLE_RESOURCE_WATCH_PERSISTENCE = load_bool("DISABLE_RESOURCE_WATCH_PERSISTENCE", False)
 
+# When true, logs are emitted as JSON (one object per line) instead of the default
+# colored text format. Useful for log scrapers like Filebeat. Defaults to false.
+ENABLE_JSON_LOGS_FORMAT = load_bool("ENABLE_JSON_LOGS_FORMAT", False)
+
 PROMETHEUS_ERROR_LOG_PERIOD_SEC = int(os.environ.get("DISCOVERY_MAX_BATCHES", 14400))
 
 RRM_PERIOD_SEC = int(os.environ.get("RRM_PERIOD_SEC", 90))

robusta_api-0.46.0/src/robusta/runner/log_init.py

@@ -0,0 +1,44 @@
+import logging
+import os
+import os.path
+import sys
+
+import colorlog
+from pythonjsonlogger.json import JsonFormatter
+
+from robusta.core.model.env_vars import ENABLE_JSON_LOGS_FORMAT
+
+
+def init_logging():
+    logging_level = os.environ.get("LOG_LEVEL", "INFO")
+    logging_datefmt = "%Y-%m-%d %H:%M:%S"
+
+    if ENABLE_JSON_LOGS_FORMAT:
+        # JSON logs (one object per line) are easier for log scrapers like
+        # Filebeat to index, search, and filter. Rename levelname -> severity
+        # to match the convention used across Robusta services (relay, holmes).
+        # Avoid printing anything to stdout here so the JSON stream is not
+        # corrupted by a plain-text line.
+        handler = logging.StreamHandler(sys.stdout)
+        handler.setFormatter(
+            JsonFormatter(
+                fmt="%(asctime)s %(levelname)s %(name)s %(filename)s %(lineno)d %(funcName)s %(message)s",
+                datefmt="%Y-%m-%dT%H:%M:%S",
+                rename_fields={"levelname": "severity"},
+            )
+        )
+        logging.basicConfig(handlers=[handler], level=logging_level, force=True)
+    else:
+        logging_format = "%(log_color)s%(asctime)s.%(msecs)03d %(levelname)-8s %(message)s"
+        # force=True so a prior configuration (e.g. a JSON handler from an
+        # earlier init_logging() call) is replaced, mirroring the JSON branch.
+        colorlog.basicConfig(
+            format=logging_format, level=logging_level, datefmt=logging_datefmt, force=True
+        )
+
+    logging.getLogger().setLevel(logging_level)
+    for logger_name in ["werkzeug", "telethon"]:
+        log = logging.getLogger(logger_name)
+        log.setLevel(logging.ERROR)
+
+    logging.info(f"logger initialized using {logging_level} log level")

robusta_api-0.45.0/src/robusta/runner/log_init.py

@@ -1,21 +0,0 @@
-import logging
-import os
-import os.path
-
-import colorlog
-
-
-def init_logging():
-    logging_level = os.environ.get("LOG_LEVEL", "INFO")
-    logging_format = "%(log_color)s%(asctime)s.%(msecs)03d %(levelname)-8s %(message)s"
-    logging_datefmt = "%Y-%m-%d %H:%M:%S"
-
-    print("setting up colored logging")
-    colorlog.basicConfig(format=logging_format, level=logging_level, datefmt=logging_datefmt)
-
-    logging.getLogger().setLevel(logging_level)
-    for logger_name in ["werkzeug", "telethon"]:
-        log = logging.getLogger(logger_name)
-        log.setLevel(logging.ERROR)
-
-    logging.info(f"logger initialized using {logging_level} log level")