search

pyupio / safety

Safety checks Python dependencies for known security vulnerabilities and suggests the proper remediations for vulnerabilities detected.
https://safetycli.com/product/safety-cli
MIT License
1.73k stars 148 forks source link

failure to pip install safety on macOS with python 3.13 #627

Open ikappaki opened 3 weeks ago

ikappaki commented 3 weeks ago

Checklist

Safety version

pip install safety

Python version

3.13.0

Operating System

macOS 14.5

Describe the problem you'd like to have solved

safety fails to install with python 3.13 on macOS

Describe the ideal solution

Should be able to pip install safety

Alternatives and current workarounds

pip install safety pydantic-core>=2.25.0

Additional context

No response

What I Did

install python 3.13.0 on macOS

$ python3 -m venv venvs/py13-safety
$ source venvs/py13-safety/bin/activate
% pip install safety
Collecting safety
  Using cached safety-3.2.10-py3-none-any.whl.metadata (39 kB)
Collecting setuptools>=65.5.1 (from safety)
  Using cached setuptools-75.3.0-py3-none-any.whl.metadata (6.9 kB)
Collecting Click>=8.0.2 (from safety)
  Using cached click-8.1.7-py3-none-any.whl.metadata (3.0 kB)
Collecting urllib3>=1.26.5 (from safety)
  Using cached urllib3-2.2.3-py3-none-any.whl.metadata (6.5 kB)
Collecting requests (from safety)
  Using cached requests-2.32.3-py3-none-any.whl.metadata (4.6 kB)
Collecting packaging>=21.0 (from safety)
  Using cached packaging-24.1-py3-none-any.whl.metadata (3.2 kB)
Collecting dparse>=0.6.4b0 (from safety)
  Using cached dparse-0.6.4b0-py3-none-any.whl.metadata (5.5 kB)
Collecting ruamel.yaml>=0.17.21 (from safety)
  Using cached ruamel.yaml-0.18.6-py3-none-any.whl.metadata (23 kB)
Collecting jinja2>=3.1.0 (from safety)
  Using cached jinja2-3.1.4-py3-none-any.whl.metadata (2.6 kB)
Collecting marshmallow>=3.15.0 (from safety)
  Using cached marshmallow-3.23.0-py3-none-any.whl.metadata (7.6 kB)
Collecting Authlib>=1.2.0 (from safety)
  Using cached Authlib-1.3.2-py2.py3-none-any.whl.metadata (3.9 kB)
Collecting rich (from safety)
  Using cached rich-13.9.3-py3-none-any.whl.metadata (18 kB)
Collecting typer (from safety)
  Using cached typer-0.12.5-py3-none-any.whl.metadata (15 kB)
Collecting pydantic>=1.10.12 (from safety)
  Using cached pydantic-2.9.2-py3-none-any.whl.metadata (149 kB)
Collecting safety-schemas>=0.0.8 (from safety)
  Using cached safety_schemas-0.0.8-py3-none-any.whl.metadata (1.2 kB)
Collecting typing-extensions>=4.7.1 (from safety)
  Using cached typing_extensions-4.12.2-py3-none-any.whl.metadata (3.0 kB)
Collecting filelock~=3.12.2 (from safety)
  Using cached filelock-3.12.4-py3-none-any.whl.metadata (2.8 kB)
Collecting psutil~=6.0.0 (from safety)
  Using cached psutil-6.0.0-cp38-abi3-macosx_11_0_arm64.whl.metadata (21 kB)
Collecting cryptography (from Authlib>=1.2.0->safety)
  Using cached cryptography-43.0.3-cp39-abi3-macosx_10_9_universal2.whl.metadata (5.4 kB)
Collecting MarkupSafe>=2.0 (from jinja2>=3.1.0->safety)
  Using cached MarkupSafe-3.0.2-cp313-cp313-macosx_11_0_arm64.whl.metadata (4.0 kB)
Collecting annotated-types>=0.6.0 (from pydantic>=1.10.12->safety)
  Using cached annotated_types-0.7.0-py3-none-any.whl.metadata (15 kB)
Collecting pydantic-core==2.23.4 (from pydantic>=1.10.12->safety)
  Using cached pydantic_core-2.23.4-cp313-cp313-macosx_11_0_arm64.whl.metadata (6.6 kB)
Collecting pydantic>=1.10.12 (from safety)
  Using cached pydantic-2.5.3-py3-none-any.whl.metadata (65 kB)
Collecting pydantic-core==2.14.6 (from pydantic>=1.10.12->safety)
  Using cached pydantic_core-2.14.6.tar.gz (360 kB)
  Installing build dependencies ... done
  Getting requirements to build wheel ... done
  Preparing metadata (pyproject.toml) ... done
Collecting charset-normalizer<4,>=2 (from requests->safety)
  Using cached charset_normalizer-3.4.0-cp313-cp313-macosx_11_0_arm64.whl.metadata (34 kB)
Collecting idna<4,>=2.5 (from requests->safety)
  Using cached idna-3.10-py3-none-any.whl.metadata (10 kB)
Collecting certifi>=2017.4.17 (from requests->safety)
  Using cached certifi-2024.8.30-py3-none-any.whl.metadata (2.2 kB)
Collecting markdown-it-py>=2.2.0 (from rich->safety)
  Using cached markdown_it_py-3.0.0-py3-none-any.whl.metadata (6.9 kB)
Collecting pygments<3.0.0,>=2.13.0 (from rich->safety)
  Using cached pygments-2.18.0-py3-none-any.whl.metadata (2.5 kB)
Collecting shellingham>=1.3.0 (from typer->safety)
  Using cached shellingham-1.5.4-py2.py3-none-any.whl.metadata (3.5 kB)
Collecting mdurl~=0.1 (from markdown-it-py>=2.2.0->rich->safety)
  Using cached mdurl-0.1.2-py3-none-any.whl.metadata (1.6 kB)
Collecting cffi>=1.12 (from cryptography->Authlib>=1.2.0->safety)
  Using cached cffi-1.17.1-cp313-cp313-macosx_11_0_arm64.whl.metadata (1.5 kB)
Collecting pycparser (from cffi>=1.12->cryptography->Authlib>=1.2.0->safety)
  Using cached pycparser-2.22-py3-none-any.whl.metadata (943 bytes)
Using cached safety-3.2.10-py3-none-any.whl (175 kB)
Using cached Authlib-1.3.2-py2.py3-none-any.whl (225 kB)
Using cached click-8.1.7-py3-none-any.whl (97 kB)
Using cached dparse-0.6.4b0-py3-none-any.whl (11 kB)
Using cached filelock-3.12.4-py3-none-any.whl (11 kB)
Using cached jinja2-3.1.4-py3-none-any.whl (133 kB)
Using cached marshmallow-3.23.0-py3-none-any.whl (49 kB)
Using cached packaging-24.1-py3-none-any.whl (53 kB)
Using cached psutil-6.0.0-cp38-abi3-macosx_11_0_arm64.whl (251 kB)
Using cached ruamel.yaml-0.18.6-py3-none-any.whl (117 kB)
Using cached safety_schemas-0.0.8-py3-none-any.whl (28 kB)
Using cached pydantic-2.5.3-py3-none-any.whl (381 kB)
Using cached setuptools-75.3.0-py3-none-any.whl (1.3 MB)
Using cached typing_extensions-4.12.2-py3-none-any.whl (37 kB)
Using cached urllib3-2.2.3-py3-none-any.whl (126 kB)
Using cached requests-2.32.3-py3-none-any.whl (64 kB)
Using cached rich-13.9.3-py3-none-any.whl (242 kB)
Using cached typer-0.12.5-py3-none-any.whl (47 kB)
Using cached annotated_types-0.7.0-py3-none-any.whl (13 kB)
Using cached certifi-2024.8.30-py3-none-any.whl (167 kB)
Using cached charset_normalizer-3.4.0-cp313-cp313-macosx_11_0_arm64.whl (119 kB)
Using cached idna-3.10-py3-none-any.whl (70 kB)
Using cached markdown_it_py-3.0.0-py3-none-any.whl (87 kB)
Using cached MarkupSafe-3.0.2-cp313-cp313-macosx_11_0_arm64.whl (12 kB)
Using cached pygments-2.18.0-py3-none-any.whl (1.2 MB)
Using cached shellingham-1.5.4-py2.py3-none-any.whl (9.8 kB)
Using cached cryptography-43.0.3-cp39-abi3-macosx_10_9_universal2.whl (6.2 MB)
Using cached cffi-1.17.1-cp313-cp313-macosx_11_0_arm64.whl (178 kB)
Using cached mdurl-0.1.2-py3-none-any.whl (10.0 kB)
Using cached pycparser-2.22-py3-none-any.whl (117 kB)
Building wheels for collected packages: pydantic-core
  Building wheel for pydantic-core (pyproject.toml) ... error
  error: subprocess-exited-with-error

  × Building wheel for pydantic-core (pyproject.toml) did not run successfully.
  │ exit code: 1
  ╰─> [114 lines of output]
      Running `maturin pep517 build-wheel -i /Users/xyz/venvs/py13-safety/bin/python3.13 --compatibility off`
      📦 Including license file "/private/var/folders/pk/p3xmfrr56rjccwsylycz47280000gn/T/pip-install-vpi_kipn/pydantic-core_afd08d0e10384a60a831731e1620b0d0/LICENSE"
      🍹 Building a mixed python/rust project
      🔗 Found pyo3 bindings
      🐍 Found CPython 3.13 at /Users/xyz/venvs/py13-safety/bin/python3.13
      📡 Using build options features, bindings from pyproject.toml
      💻 Using `MACOSX_DEPLOYMENT_TARGET=11.0` for aarch64-apple-darwin by default
         Compiling autocfg v1.1.0
         Compiling proc-macro2 v1.0.69
         Compiling quote v1.0.29
         Compiling target-lexicon v0.12.9
         Compiling unicode-ident v1.0.10
         Compiling python3-dll-a v0.2.9
         Compiling once_cell v1.18.0
         Compiling libc v0.2.147
         Compiling static_assertions v1.1.0
         Compiling heck v0.4.1
         Compiling lexical-util v0.8.5
         Compiling version_check v0.9.4
         Compiling num-traits v0.2.16
         Compiling cfg-if v1.0.0
         Compiling lock_api v0.4.10
         Compiling num-integer v0.1.45
         Compiling parking_lot_core v0.9.8
         Compiling rustversion v1.0.13
         Compiling memoffset v0.9.0
         Compiling syn v2.0.38
         Compiling pyo3-build-config v0.20.0
         Compiling num-bigint v0.4.4
         Compiling scopeguard v1.1.0
         Compiling smallvec v1.11.1
         Compiling tinyvec_macros v0.1.1
         Compiling tinyvec v1.6.0
         Compiling lexical-parse-integer v0.8.6
         Compiling lexical-write-integer v0.8.5
         Compiling ahash v0.8.6
         Compiling memchr v2.6.3
         Compiling serde v1.0.190
         Compiling lexical-parse-float v0.8.5
         Compiling aho-corasick v1.0.2
         Compiling lexical-write-float v0.8.5
         Compiling parking_lot v0.12.1
         Compiling unicode-normalization v0.1.22
         Compiling getrandom v0.2.10
         Compiling pyo3-macros-backend v0.20.0
         Compiling pyo3-ffi v0.20.0
         Compiling pyo3 v0.20.0
         Compiling unindent v0.2.3
         Compiling unicode-bidi v0.3.13
         Compiling indoc v2.0.4
         Compiling equivalent v1.0.1
         Compiling zerocopy v0.7.20
         Compiling percent-encoding v2.3.0
         Compiling regex-syntax v0.8.2
         Compiling hashbrown v0.14.0
         Compiling serde_json v1.0.108
         Compiling form_urlencoded v1.2.0
         Compiling indexmap v2.0.0
         Compiling idna v0.4.0
         Compiling pydantic-core v2.14.6 (/private/var/folders/pk/p3xmfrr56rjccwsylycz47280000gn/T/pip-install-vpi_kipn/pydantic-core_afd08d0e10384a60a831731e1620b0d0)
         Compiling lexical-core v0.8.5
         Compiling ryu v1.0.14
         Compiling itoa v1.0.8
         Compiling serde_derive v1.0.190
         Compiling strum_macros v0.25.3
         Compiling enum_dispatch v0.3.12
         Compiling url v2.4.1
      error: failed to run custom build command for `pydantic-core v2.14.6 (/private/var/folders/pk/p3xmfrr56rjccwsylycz47280000gn/T/pip-install-vpi_kipn/pydantic-core_afd08d0e10384a60a831731e1620b0d0)`

      Caused by:
        process didn't exit successfully: `/private/var/folders/pk/p3xmfrr56rjccwsylycz47280000gn/T/pip-install-vpi_kipn/pydantic-core_afd08d0e10384a60a831731e1620b0d0/target/release/build/pydantic-core-44937537213b23ed/build-script-build` (exit status: 101)
        --- stdout
        cargo:rustc-cfg=Py_3_6
        cargo:rustc-cfg=Py_3_7
        cargo:rustc-cfg=Py_3_8
        cargo:rustc-cfg=Py_3_9
        cargo:rustc-cfg=Py_3_10
        cargo:rustc-cfg=Py_3_11
        cargo:rustc-cfg=Py_3_12
        cargo:rustc-cfg=Py_3_13
        cargo:rerun-if-changed=python/pydantic_core/core_schema.py
        cargo:rerun-if-changed=generate_self_schema.py

        --- stderr
        Traceback (most recent call last):
          File "/private/var/folders/pk/p3xmfrr56rjccwsylycz47280000gn/T/pip-install-vpi_kipn/pydantic-core_afd08d0e10384a60a831731e1620b0d0/generate_self_schema.py", line 192, in eval_forward_ref
            return type_._evaluate(core_schema.__dict__, None, set())
                   ~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
        TypeError: ForwardRef._evaluate() missing 1 required keyword-only argument: 'recursive_guard'

        During handling of the above exception, another exception occurred:

        Traceback (most recent call last):
          File "/private/var/folders/pk/p3xmfrr56rjccwsylycz47280000gn/T/pip-install-vpi_kipn/pydantic-core_afd08d0e10384a60a831731e1620b0d0/generate_self_schema.py", line 240, in <module>
            main()
            ~~~~^^
          File "/private/var/folders/pk/p3xmfrr56rjccwsylycz47280000gn/T/pip-install-vpi_kipn/pydantic-core_afd08d0e10384a60a831731e1620b0d0/generate_self_schema.py", line 210, in main
            value = get_schema(s, definitions)
          File "/private/var/folders/pk/p3xmfrr56rjccwsylycz47280000gn/T/pip-install-vpi_kipn/pydantic-core_afd08d0e10384a60a831731e1620b0d0/generate_self_schema.py", line 54, in get_schema
            return type_dict_schema(obj, definitions)
          File "/private/var/folders/pk/p3xmfrr56rjccwsylycz47280000gn/T/pip-install-vpi_kipn/pydantic-core_afd08d0e10384a60a831731e1620b0d0/generate_self_schema.py", line 152, in type_dict_schema
            field_type = eval_forward_ref(field_type)
          File "/private/var/folders/pk/p3xmfrr56rjccwsylycz47280000gn/T/pip-install-vpi_kipn/pydantic-core_afd08d0e10384a60a831731e1620b0d0/generate_self_schema.py", line 195, in eval_forward_ref
            return type_._evaluate(core_schema.__dict__, None)
                   ~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^
        TypeError: ForwardRef._evaluate() missing 1 required keyword-only argument: 'recursive_guard'
        thread 'main' panicked at build.rs:29:9:
        generate_self_schema.py failed with exit status: 1
        note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
      warning: build failed, waiting for other jobs to finish...
      💥 maturin failed
        Caused by: Failed to build a native library through cargo
        Caused by: Cargo build finished with "exit status: 101": `env -u CARGO MACOSX_DEPLOYMENT_TARGET="11.0" PYO3_ENVIRONMENT_SIGNATURE="cpython-3.13-64bit" PYO3_PYTHON="/Users/xyz/venvs/py13-safety/bin/python3.13" PYTHON_SYS_EXECUTABLE="/Users/xyz/venvs/py13-safety/bin/python3.13" "cargo" "rustc" "--features" "pyo3/extension-module" "--message-format" "json-render-diagnostics" "--manifest-path" "/private/var/folders/pk/p3xmfrr56rjccwsylycz47280000gn/T/pip-install-vpi_kipn/pydantic-core_afd08d0e10384a60a831731e1620b0d0/Cargo.toml" "--release" "--lib" "--crate-type" "cdylib" "--" "-C" "link-arg=-undefined" "-C" "link-arg=dynamic_lookup" "-C" "link-args=-Wl,-install_name,@rpath/pydantic_core._pydantic_core.cpython-313-darwin.so"`
      Error: command ['maturin', 'pep517', 'build-wheel', '-i', '/Users/xyz/venvs/py13-safety/bin/python3.13', '--compatibility', 'off'] returned non-zero exit status 1
      [end of output]

  note: This error originates from a subprocess, and is likely not a problem with pip.
  ERROR: Failed building wheel for pydantic-core
Failed to build pydantic-core

[notice] A new release of pip is available: 24.2 -> 24.3.1
[notice] To update, run: pip install --upgrade pip
ERROR: ERROR: Failed to build installable wheels for some pyproject.toml based projects (pydantic-core)
github-actions[bot] commented 3 weeks ago

Hi @ikappaki, thank you for opening this issue!

We appreciate your effort in reporting this. Our team will review it and get back to you soon. If you have any additional details or updates, feel free to add them to this issue.

Note: If this is a serious security issue that could impact the security of Safety CLI users, please email security@safetycli.com immediately.

Thank you for contributing to Safety CLI!