Resolve Python related Dependabot alerts

CDLUC3 / ezid

CDLUC3 ezid

MIT License

11 stars 4 forks source link

Resolve Python related Dependabot alerts #527

Closed jsjiang closed 7 months ago

jsjiang commented 7 months ago

High security alerts

pypa/setuptools vulnerable to Regular Expression Denial of Service (ReDoS) (7.5/10)

Moderate alerts

Pygments vulnerable to ReDoS (5/10)
Unintended leak of Proxy-Authorization header in requests (6.1)

All require package version changes in the requirements.txt and requirements-dev.txt files. Update these files, test and deploy the fixes to clear the alerts.

jsjiang commented 7 months ago

Created release candiate tag v3.2.2rc0
Deployed v3.2.2rc0 on EZID-stg
Tested with the `verify_ezid_after_patching.py script