Skip to content

Bump vulnerable dependencies (filelock, urllib3, virtualenv)#382

Open
nthmost-orkes wants to merge 1 commit intomainfrom
fix/security-dependency-bumps
Open

Bump vulnerable dependencies (filelock, urllib3, virtualenv)#382
nthmost-orkes wants to merge 1 commit intomainfrom
fix/security-dependency-bumps

Conversation

@nthmost-orkes
Copy link

Summary

  • Add minimum version constraints for vulnerable dependencies
  • urllib3 >= 2.6.3, filelock >= 3.20.3, virtualenv >= 20.36.1

Vulnerabilities Fixed

Package Installed Fixed Issues
urllib3 2.5.0 >= 2.6.3 GHSA-38jv-5279-wg99, GHSA-2xpw-w6gg-jr37, GHSA-gm62-xv2j-4w53
filelock 3.18.0 >= 3.20.3 GHSA-qmgc-5h2g-mvrw, GHSA-w853-jp5j-5j7f
virtualenv 20.31.2 >= 20.36.1 GHSA-597g-3phw-6986

Fixes #379, #380, #381

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

security Security-related issues vulnerability Dependency vulnerability

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[GHSA-qmgc-5h2g-mvrw] filelock@3.18.0: TOCTOU symlink vulnerabilities

2 participants