IBM / detect-secrets

An enterprise friendly way of detecting and preventing secrets in code.
Apache License 2.0
74 stars 46 forks source link

chore: Unpin requests dep, pin urllib3 dep #130

Closed bigpick closed 1 year ago

bigpick commented 1 year ago

Info

Unpins the requests dependency, but adds a pinned urllib3 dependency. Upstream requests says "this isn't a requests problem, its a how you're getting urllib3 problem"; Also - CVE-2023-32681 is getting flagged in requests < 2.31.0, so hopefully this would resolve that, as well.

Misc

From a fresh python 3.9.16 venv via direnv:

export PYENV_VERSION=3.9.16

layout python3

Then

which detect-secrets
detect-secrets not found

pip install --upgrade "git+https://github.com/bigpick/detect-secrets.git@unpin-requests-dep#egg=detect-secrets"

detect-secrets --version
0.13.1+ibm.61.dss

detect-secrets scan --update .secrets.baseline --use-all-plugins .
echo $?
0

detect-secrets audit .secrets.baseline
Nothing to audit!