search

Bouni / ard-mediathek

commandline download of ARD videos
MIT License
16 stars 3 forks source link

Security issue with requests #19

Closed Bouni closed 5 years ago

Bouni commented 5 years ago

I've never worked with pipenv before, @steffenschroeder is it enough to just update the pipfile or do we need to update the pipfile.lock as well? If so could you help with a pull request with the requests dependecy set to >= 2.20.0?

steffenschroeder commented 5 years ago

I’ll take a look

steffenschroeder commented 5 years ago

Basically there should be a pipenv update which updates the Pipfile.lock. Commiting that one is sufficient

Bouni commented 5 years ago

@steffenschroeder So the updated pipfile I've commited is sufficent? As soon as a user starts pipenv, the .lock file generated automatically?

steffenschroeder commented 5 years ago

I don’t have my laptop with me. So I can’t do it myself at the moment. Basically, without changing the pipfile you should do pipenv update request. That updates the pipfile.lock which is the solution

Bouni commented 5 years ago

Thanks @steffenschroeder for solving this with #20