AnacondaRecipes / repodata-hotfixes

Changes to package metadata to fix behavior
BSD 3-Clause "New" or "Revised" License
14 stars 20 forks source link

Removing py hotfix for CVE-2022-42969 #214

Closed psteyer closed 8 months ago

psteyer commented 8 months ago

Removing the hotfix due to it currently adding in CVE-2022-42969 into pytest through py.

CVE: https://nvd.nist.gov/vuln/detail/CVE-2022-42969

Jira Ticket: https://anaconda.atlassian.net/browse/CVE-566

CVE Curation: https://github.com/anaconda-distribution/cve-curations/pull/129/files

I grepped through our pytest plugin feedstocks to look for any py dependencies. In the following PR's I'm adding py in as a dependency instead of using the hotfix.

pytest-benchmark-feedstock: https://github.com/AnacondaRecipes/pytest-benchmark-feedstock/pull/3 pytest-cov-feedstock: https://github.com/AnacondaRecipes/pytest-cov-feedstock/pull/5 pytest-csv-feedstock: https://github.com/AnacondaRecipes/pytest-csv-feedstock/pull/1 pytest-flake8-feedstock: https://github.com/AnacondaRecipes/pytest-flake8-feedstock/pull/1 pytest-forked-feedstock: https://github.com/AnacondaRecipes/pytest-forked-feedstock/pull/2 pytest-mpi-feedstock: https://github.com/AnacondaRecipes/pytest-mpi-feedstock/pull/1 pytest-rerunfailures-feedstock: https://github.com/AnacondaRecipes/pytest-rerunfailures-feedstock/pull/3