taskqueue-toolkit 0.1.0__tar.gz → 0.1.1__tar.gz

{taskqueue_toolkit-0.1.0 → taskqueue_toolkit-0.1.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: taskqueue-toolkit
-Version: 0.1.0
+Version: 0.1.1
 Summary: Broker-agnostic async task queue (RabbitMQ, SQS, SNS, Redis Streams, Pub/Sub) with a Postgres outbox pattern
 Author: Walid Boughdiri
 Author-email: Walid Boughdiri <walid.boughdiri@gmail.com>
@@ -152,6 +152,12 @@ Each adapter constructor takes an injectable client/connection factory for exact
 
 Create one broker instance per test — each owns its own isolated in-memory state, so there's nothing to reset between tests and no risk of one test's queue leaking into another's.
 
+## Security
+
+`Decoder[T]` runs on bytes received from a broker — in most deployments, a source outside this process's control. Using an unsafe deserializer (`pickle.loads`, `yaml.load` without `SafeLoader`, `eval`, ...) as your `decode` callback means whoever can publish to your queue/topic can run arbitrary code in your consumer. Use a safe format (JSON, msgpack, protobuf, ...) unless every publisher is fully trusted.
+
+This package's own code is checked on every push/PR and before every release via [bandit](https://bandit.readthedocs.io/) (unsafe code patterns) and [pip-audit](https://github.com/pypa/pip-audit) (known CVEs in resolved dependencies), alongside ruff, mypy, and the test suite. Found a vulnerability? Please open an issue.
+
 ## Development
 
 ```bash
@@ -160,4 +166,6 @@ uv run pytest
 uv run ruff check .
 uv run ruff format .
 uv run mypy .
+uvx bandit -r src/
+uvx pip-audit --path .venv
 ```

{taskqueue_toolkit-0.1.0 → taskqueue_toolkit-0.1.1}/README.md

@@ -117,6 +117,12 @@ Each adapter constructor takes an injectable client/connection factory for exact
 
 Create one broker instance per test — each owns its own isolated in-memory state, so there's nothing to reset between tests and no risk of one test's queue leaking into another's.
 
+## Security
+
+`Decoder[T]` runs on bytes received from a broker — in most deployments, a source outside this process's control. Using an unsafe deserializer (`pickle.loads`, `yaml.load` without `SafeLoader`, `eval`, ...) as your `decode` callback means whoever can publish to your queue/topic can run arbitrary code in your consumer. Use a safe format (JSON, msgpack, protobuf, ...) unless every publisher is fully trusted.
+
+This package's own code is checked on every push/PR and before every release via [bandit](https://bandit.readthedocs.io/) (unsafe code patterns) and [pip-audit](https://github.com/pypa/pip-audit) (known CVEs in resolved dependencies), alongside ruff, mypy, and the test suite. Found a vulnerability? Please open an issue.
+
 ## Development
 
 ```bash
@@ -125,4 +131,6 @@ uv run pytest
 uv run ruff check .
 uv run ruff format .
 uv run mypy .
+uvx bandit -r src/
+uvx pip-audit --path .venv
 ```

{taskqueue_toolkit-0.1.0 → taskqueue_toolkit-0.1.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "taskqueue-toolkit"
-version = "0.1.0"
+version = "0.1.1"
 description = "Broker-agnostic async task queue (RabbitMQ, SQS, SNS, Redis Streams, Pub/Sub) with a Postgres outbox pattern"
 readme = "README.md"
 license = "Apache-2.0"

{taskqueue_toolkit-0.1.0 → taskqueue_toolkit-0.1.1}/pyproject.toml.orig

@@ -1,6 +1,6 @@
 [project]
 name = "taskqueue-toolkit"
-version = "0.1.0"
+version = "0.1.1"
 description = "Broker-agnostic async task queue (RabbitMQ, SQS, SNS, Redis Streams, Pub/Sub) with a Postgres outbox pattern"
 readme = "README.md"
 license = "Apache-2.0"

{taskqueue_toolkit-0.1.0 → taskqueue_toolkit-0.1.1}/src/taskqueue_toolkit/queue/sns.py

@@ -6,10 +6,13 @@ import logging
 from collections.abc import AsyncIterator, Callable
 from contextlib import AbstractAsyncContextManager, asynccontextmanager
 from dataclasses import dataclass, field
+from typing import TYPE_CHECKING
 
 import aioboto3
-from types_aiobotocore_sns.client import SNSClient
-from types_aiobotocore_sqs.client import SQSClient
+
+if TYPE_CHECKING:
+    from types_aiobotocore_sns.client import SNSClient
+    from types_aiobotocore_sqs.client import SQSClient
 
 from taskqueue_toolkit.queue.aws_session import aws_session_kwargs
 from taskqueue_toolkit.queue.dsn import SnsDsn
@@ -20,7 +23,7 @@ logger = logging.getLogger(__name__)
 _LONG_POLL_WAIT_SECONDS = 10
 _SUBSCRIBER_QUEUE_SUFFIX = "-subscriber"
 
-ClientFactory = Callable[[SnsDsn], AbstractAsyncContextManager[tuple[SNSClient, SQSClient]]]
+ClientFactory = Callable[[SnsDsn], AbstractAsyncContextManager["tuple[SNSClient, SQSClient]"]]
 
 
 @asynccontextmanager

{taskqueue_toolkit-0.1.0 → taskqueue_toolkit-0.1.1}/src/taskqueue_toolkit/queue/sqs.py

@@ -5,10 +5,12 @@ import logging
 from collections.abc import AsyncIterator, Callable
 from contextlib import AbstractAsyncContextManager
 from dataclasses import dataclass, field
-from typing import cast
+from typing import TYPE_CHECKING, cast
 
 import aioboto3
-from types_aiobotocore_sqs.client import SQSClient
+
+if TYPE_CHECKING:
+    from types_aiobotocore_sqs.client import SQSClient
 
 from taskqueue_toolkit.queue.aws_session import aws_session_kwargs
 from taskqueue_toolkit.queue.dsn import SqsDsn
@@ -18,7 +20,7 @@ logger = logging.getLogger(__name__)
 
 _LONG_POLL_WAIT_SECONDS = 10
 
-ClientFactory = Callable[[SqsDsn], AbstractAsyncContextManager[SQSClient]]
+ClientFactory = Callable[[SqsDsn], AbstractAsyncContextManager["SQSClient"]]
 
 
 def _default_client_factory(dsn: SqsDsn) -> AbstractAsyncContextManager[SQSClient]:

{taskqueue_toolkit-0.1.0 → taskqueue_toolkit-0.1.1}/src/taskqueue_toolkit/queue/task_queue.py

@@ -7,6 +7,12 @@ T = TypeVar("T")
 T_co = TypeVar("T_co", covariant=True)
 
 Encoder = Callable[[T], bytes]
+# SECURITY: Decoder runs on bytes received from a broker — a source outside
+# this process's control in most deployments. Using an unsafe deserializer
+# here (pickle.loads, yaml.load without SafeLoader, eval, ...) turns
+# whoever can publish to your queue/topic into someone who can run
+# arbitrary code in your consumer. Prefer a safe format (json, msgpack,
+# protobuf) unless every publisher is fully trusted.
 Decoder = Callable[[bytes], T]