Bump twisted from 22.8.0 to 22.10.0

[dependabot]

Bumps twisted from 22.8.0 to 22.10.0.

Release notes

Sourced from twisted's releases.

Twisted 22.10.0 (2022-10-30)

This release contains a security fix for CVE-2022-39348. This is a low-severity security bug.

Twisted 22.10.0rc1 release candidate was released on 2022-10-26 and there are no changes between the release candidate and the final release.

Features

• The systemd: endpoint parser now supports "named" file descriptors. This is a more reliable mechanism for choosing among several inherited descriptors. (#8147)

Improved Documentation

• The systemd endpoint parser's index parameter is now documented as leading to non-deterministic results in which descriptor is selected. The new name parameter is now documented as preferred. (#8146)
• The implementers of Zope interfaces are once more displayed in the documentations. (#11690)

Deprecations and Removals

• twisted.protocols.dict, which was deprecated in 17.9, has been removed. (#11725)

Misc

• #11573, #11599, #11616, #11628, #11631, #11640, #11645, #11647, #11652, #11664, #11674, #11679, #11686, #11692, #11694, #11696, #11700, #11702, #11713, #11715, #11721

Conch

Bugfixes

- twisted.conch.manhole.ManholeInterpreter now captures tracebacks even if sys.excepthook has been modified. ([#11638](https://github.com/twisted/twisted/issues/11638))
Web
Features

... (truncated)

Changelog

Sourced from twisted's changelog.

Twisted 22.10.0 (2022-10-30)

This release contains a security fix for CVE-2022-39348. This is a low-severity security bug.

Twisted 22.10.0rc1 release candidate was released on 2022-10-26 and there are no changes between the release candidate and the final release.

Features

• The systemd: endpoint parser now supports "named" file descriptors. This is a more reliable mechanism for choosing among several inherited descriptors. (#8147)

Improved Documentation

• The systemd endpoint parser's index parameter is now documented as leading to non-deterministic results in which descriptor is selected. The new name parameter is now documented as preferred. (#8146)
• The implementers of Zope interfaces are once more displayed in the documentations. (#11690)

Deprecations and Removals

• twisted.protocols.dict, which was deprecated in 17.9, has been removed. (#11725)

Misc

• #11573, #11599, #11616, #11628, #11631, #11640, #11645, #11647, #11652, #11664, #11674, #11679, #11686, #11692, #11694, #11696, #11700, #11702, #11713, #11715, #11721

Conch

Bugfixes

- twisted.conch.manhole.ManholeInterpreter now captures tracebacks even if sys.excepthook has been modified. ([#11638](https://github.com/twisted/twisted/issues/11638))
Web
Features

... (truncated)

Commits

• 39ee213 Update news for final version.
• 7e76513 python -m incremental.update Twisted --newversion 22.10.0
• 3f1f502 Apply suggestions from twm.
• 3185b01 Add info about CVE at the start of the release notes.
• 15aa477 tox -e towncrier
• 0a29d34 python -m incremental.update Twisted --rc
• f2f5e81 Merge pull request from GHSA-vg46-2rrj-3647
• b0545bc Merge branch 'trunk' into advisory-fix-1
• 50761f4 #11715: Use NEXT in deprecation examples (#11720)
• 927a5dc Add newsfragment
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

[portante]

I think we need to reconsider our approach here.

The poetry.lock file is being updated because poetry is "solving" the dependency tree where the sdk depends on twisted. But the sdk package does not have 22.10.0 listed in its pyproject.toml, and itself is not using poetry.

Why are we committing the solved tree when it is the sdk that has the dependency problem?

I understand the solver, but I don't see why we should commit the poetry.lock when we are doing everything in containers.

We should be fixing the sdk itself with the explicit fix. And once we fix that just need poetry install in the container image.

[sandrobonazzola]

Why are we committing the solved tree when it is the sdk that has the dependency problem?

To prevent regressions due to dependency changes. The lock file certify the versions that passed the tests. If a dependency introduces a regression then the container shipping the plugin will fail despite it passes automated tests at merge time.

See also: https://python-poetry.org/docs/basic-usage/#commit-your-poetrylock-file-to-version-control

[portante]

Why are we committing the solved tree when it is the sdk that has the dependency problem?

To prevent regressions due to dependency changes.

I understand this to mean, when a container is built, the poetry install step will install the same versions of python packages in the dependency tree. Great.

But this pushes the SDK dependencies out to every single plugin that Arcalot maintains. So we are now multiplying work.

Why not instead:

• Create an SDK container, once, SDK has a poetry.lock file for it with all its dependencies resolved
• Have all supported plugins built from that official container
• Have each plugin NOT include the SDK as an explicit python dependency so that their poetry.lock files only resolve to what they use

Then somebody who wants to write their one plugin would just as the SDK as a normal dependency, if they don't want to use the SDK published container, or they can just build a container based on the SDK one.

We have too much mechanism being pushed across all the supported plugins.

[portante]

• Create an SDK container, once, SDK has a poetry.lock file for it with all its dependencies resolved

First step is to get the SDK to use poetry via PR arcalot/arcaflow-plugin-sdk-python#81.

[dependabot]

Looks like twisted is up-to-date now, so this is no longer needed.