[andrewelamb]

Problem:

• SonarCloud found three log injection alerts (pythonsecurity:S5145, alerts fix for syn.store of files with no .path, SYNR-474 #52, Session tokens and .setendpoints method #54, Query chunking, and Logout, Store/Submit #55) in synapseclient/core/version_check.py. The version check writes version strings into log and stdout messages. These strings come from data that the code does not control:

  • the current version (synapseclient.__version__)
  • latestVersion in the local package metadata
  • info.version in the PyPI JSON response

  The code only did an assert isinstance(..., str) on these values. A string such as "1.2.3\nFORGED LOG ENTRY" passes that check and can add a false line to the log. Also, assert statements are removed when Python runs with -O, so the check did not always run.

• Some locked dependencies in Pipfile.lock were out of date.

• There are five open HIGH Trivy alerts (msgpack Fix synpy167 #181 and fixed attrubute error for syn.username when not logged in (SYNPY-706) #538, urllib3 fixed comment typo (SYNPY-658) #528 and removed integration test calling POST /entity/{id}/lockAccessRequirement (SYNPY-690) #529, setuptools changed list() function to synlist() as to not overload built-in list() constructor #182). This PR does not change files for these alerts. Refer to the Trivy section below for the reason.

Solution:

• Added _validate_version() to version_check.py. It accepts a value only if the value is a str and fully matches a known version pattern: release, a/b/rc pre-release, .post, and .dev versions (for example 4.14.0, 4.14.0rc1, 4.14.0.post1, 0.5.1.dev200). If the value does not match, it raises ValueError. Newline characters and other text cannot get into a log message.
• check_for_updates(), _version_check(), and _get_version_info_from_pypi() now use _validate_version() instead of assert isinstance(...).
• Updated Pipfile.lock: certifi 2026.7.22 → 2026.10.18, setuptools 84.0.0 → 84.1.0, filelock 4.1.1 → 4.2.1, virtualenv 21.14.7 → 21.14.9.

Why the Trivy alerts will close without more changes

• The Trivy alerts do not come from synapseclient or from its declared dependencies. The daily trivy_periodic_scan.yml workflow scans the published image for the latest git tag (now v4.14.0). The Dockerfile at v4.14.0 installs python3-pip and python3-setuptools from apt and upgrades pip. pip has its own vendored copies of urllib3 and msgpack, and these copies are the old versions that Trivy finds. setup.cfg already requires urllib3>=2.8.0 and setuptools>=80.10.1. The rebuild log shows urllib3 2.8.0 and setuptools 84.2.1 installed for synapseclient.
• Fix Trivy failures blocking Docker image publishing #1468 already fixed the Dockerfile on develop. It removes the apt Python packages, runs apt-get upgrade, and uninstalls pip after it installs synapseclient. But that Dockerfile is not in a release tag yet.
• When the periodic scan fails, the workflow rebuilds the image from the latest tag (REF_TO_CHECKOUT: <latest tag>). It pushes the image and creates the next patch tag only if the rebuilt image passes Trivy. At the moment, the rebuild uses the old v4.14.0 Dockerfile, so it fails every day and opens an "unresolved container vulnerabilities" issue.
• After this PR merges and the next release is tagged, the latest tag will have the fixed Dockerfile. The periodic scan will then scan (or rebuild from) an image that does not have pip. That image will not contain the vulnerable msgpack, urllib3, or setuptools. When the new SARIF upload does not contain these findings, GitHub closes the alerts automatically.

Testing:

• Added unit tests in tests/unit/synapseclient/core/unit_test_version_check.py:
  • test_validate_version_valid: release, pre-release, post-release, and dev versions are returned unchanged.
  • test_validate_version_invalid: empty strings, non-version text, trailing \n or \r\n, leading spaces, 1..2, injected log lines, None, and integers raise ValueError.
  • test_get_version_info_from_pypi_invalid: an invalid version from the PyPI response is not returned.
  • test_version_check_invalid_local_metadata: an invalid local latestVersion is not used.
  • test_check_for_updates_invalid_current_version: an invalid current version raises ValueError, and nothing is written to stdout.