Fix robot.jar vulnerabilities CVE-2026-54512, CVE-2026-54513, CVE-202…

.copier-answers.yml

@@ -1,5 +1,5 @@
 # Changes here will be overwritten by Copier
-_commit: v8.3.1
+_commit: v8.5.0
 _src_path: gh:eccenca/cmem-plugin-template
 author_mail: cmempy-developer@eccenca.com
 author_name: eccenca GmbH

.github/workflows/check.yml

@@ -45,10 +45,6 @@ jobs:
           virtualenvs-in-project: true
           installer-parallel: true
 
-      - name: Install dynamic versioning plugin
-        run: |
-          poetry self add "poetry-dynamic-versioning[plugin]"
-
       - name: mypy
         run: |
           task check:mypy

.github/workflows/publish.yml

@@ -35,10 +35,6 @@ jobs:
           virtualenvs-in-project: true
           installer-parallel: true
 
-      - name: Install dynamic versioning plugin
-        run: |
-          poetry self add "poetry-dynamic-versioning[plugin]"
-
       - name: Publish Package
         env:
           PYPI_TOKEN: ${{ secrets.PYPI_TOKEN }}

.gitignore

@@ -138,6 +138,9 @@ dmypy.json
 # Cython debug symbols
 cython_debug/
 
+# Claude code specifics
+.claude/settings.local.json
+
 # project build plan specific ignores
 version.py
 co

.gitlab-ci.yml

@@ -1,6 +1,6 @@
 ---
 default:
-  image: docker-registry.eccenca.com/eccenca-python:v3.13.8
+  image: docker-registry.eccenca.com/eccenca-python:v3.13.13
   # all jobs can be interrupted in case a new commit is pushed
   interruptible: true
   before_script:

CHANGELOG.md

@@ -5,6 +5,16 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](http://keepachangelog.com/) and this project adheres to [Semantic Versioning](https://semver.org/)
 
+## [Unreleased]
+
+### Fixed
+
+- Fix robot.jar vulnerabilities CVE-2026-54512, CVE-2026-54513, CVE-2026-54514, CVE-2026-54515.
+
+### Changed
+
+- Update template to 8.5.0.
+
 ## [2.2.5] 2026-03-01
 
 ### Fixed

Taskfile.yaml

@@ -44,36 +44,9 @@ tasks:
     cmds:
       - mkdir -p {{.DIST_DIR}}/coverage
 
-  poetry:check:
-    internal: true
-    platforms: [darwin, linux]
-    summary: |
-      Check poetry versioning plugin. Currently not under Windows
-    run: once
-    preconditions:
-      - sh: git -C . rev-parse
-        msg: >
-          Your newly created project directory needs to be initialized
-          as a git repository.
-      - sh: '[[ {{.PDV_VERSION}} > {{.PDV_VERSION_MIN}} ]]'
-        msg: >
-          This project needs the poetry-dynamic-versioning
-          plugin > v{{.PDV_VERSION_MIN}}.
-
-          You can install it with the following command:
-          poetry self add "poetry-dynamic-versioning[plugin]"
-    vars:
-      PDV_VERSION_MIN: 0.20
-      PDV_VERSION:
-        sh: >
-            poetry self show --addons poetry-dynamic-versioning --tree
-            | head -1 | cut -d " " -f 2 | cut -d "." -f 1-2
-
   poetry:install:
     desc: Install dependencies managed by Poetry
     run: once
-    deps:
-      - poetry:check
     cmds:
       - poetry install
 
@@ -162,6 +135,7 @@ tasks:
         poetry run trivy fs
         --include-dev-deps
         --scanners vuln
+        --skip-files .poetry/plugins/poetry.lock
         --exit-code 1
         .
       - >
@@ -194,7 +168,7 @@ tasks:
     <<: *preparation
     deps:
       - clean
-      - poetry:check
     cmds:
       - poetry build
+      - poetry export --without=dev -f requirements.txt >dist/requirements.txt
 

pyproject.toml

@@ -13,33 +13,38 @@ keywords = [
 ]
 homepage = "https://github.com/eccenca/cmem-plugin-reason"
 
+[tool.poetry.requires-plugins]
+poetry-plugin-export = "^1.10.0"
+poetry-plugin-shell = "^1.0.1"
+poetry-dynamic-versioning = "^1.10.0"
+
 [tool.poetry.dependencies]# if you need to change python version here, change it also in .python-version
 python = "^3.13"
 validators = "^0.35.0"
 pathvalidate = "^3.3.1"
 inflection = "^0.5.1"
 defusedxml = "^0.7.1"
-cmem-cmempy = "^25.4.0"
+cmem-cmempy = "^25.5.0"
 
 [tool.poetry.dependencies.cmem-plugin-base]
-version = "^4.12.1"
+version = "^4.16.1"
 allow-prereleases = false
 
 [tool.poetry.group.dev.dependencies.cmem-cmemc]
 version = ">=24.2.0"
 
 [tool.poetry.group.dev.dependencies]
-deptry = "^0.24.0"
+deptry = "^0.25.1"
 genbadge = {extras = ["coverage"], version = "^1.1.3"}
-mypy = "^1.19.1"
+mypy = "^2.1.0"
 pip = "^26"
-pytest = "^9.0.2"
-pytest-cov = "^7.0.0"
+pytest = "^9.1.0"
+pytest-cov = "^7.1.0"
 pytest-dotenv = "^0.5.2"
 pytest-html = "^4.2.0"
 pytest-memray = { version = "^1.8.0",  markers = "platform_system != 'Windows'" }
-ruff = "^0.15.0"
-trivy-py-ecc = "^0.68.2.1"
+ruff = "^0.15.17"
+trivy-py-ecc = "^0.71.2.1"
 
 [build-system]
 requires = ["poetry-core>=1.0.0", "poetry-dynamic-versioning"]
@@ -72,7 +77,7 @@ exclude_also = [
 
 [tool.ruff]
 line-length = 100
-target-version = "py311"
+target-version = "py313"
 
 [tool.ruff.format]
 line-ending = "lf" # Use `\n` line endings for all files

tests/test_reason.py

@@ -37,7 +37,7 @@ def reasoner_parameter() -> str | None:
 
 
 @pytest.fixture
-def setup() -> Generator[None, Any, None]:
+def setup() -> Generator[None, Any]:
     """Set up Reason test"""
     delete(REASON_RESULT_GRAPH_IRI)
 

tests/test_validate.py

@@ -42,7 +42,7 @@ def reasoner_parameter() -> str | None:
 
 
 @pytest.fixture
-def setup() -> Generator[None, Any, None]:
+def setup() -> Generator[None, Any]:
     """Set up Validate test"""
     with suppress(Exception):
         delete_project(PROJECT_ID)