search

alec-kr / F1PyStats

An open-source Python3 package that provides Formula 1 data to developers.
GNU General Public License v3.0
54 stars 19 forks source link

Remove py package #108

Closed youpong closed 1 year ago

youpong commented 1 year ago

Description

Update dependencies to resolve the security alert.

There's a security alert about latest version of py package.

The latest version of nox no longer uses py package. Therefore, I have created this pull request to update thenox version.

The security alert recommends that pytest be updated to version 7.2.0. This is also included in this pull request.

Related Issue(s)

None.

User-facing Changes

None.

Screenshots (If necessary)

None.

alec-kr commented 1 year ago

@youpong There seems to be an error with Codecov now. Could this be related to your changes?

Error: ErrorDetail(string='Unable to locate build via Github Actions API. Please upload with the Codecov repository upload token to resolve issue.', code='not_found'

youpong commented 1 year ago

I don't think my change caused the error. Let's see if the codecov error is temporary or not.

codecov[bot] commented 1 year ago

Codecov Report

Base: 100.00% // Head: 100.00% // No change to project coverage :thumbsup:

Coverage data is based on head (f23be67) compared to base (eb049b9). Patch has no changes to coverable lines.

Additional details and impacted files ```diff @@ Coverage Diff @@ ## main #108 +/- ## ========================================= Coverage 100.00% 100.00% ========================================= Files 44 44 Lines 892 892 ========================================= Hits 892 892 ``` Help us with your feedback. Take ten seconds to tell us [how you rate us](https://about.codecov.io/nps?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=None). Have a feature suggestion? [Share it here.](https://app.codecov.io/gh/feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=None)

:umbrella: View full report at Codecov.
:loudspeaker: Do you have feedback about the report comment? Let us know in this issue.

alec-kr commented 1 year ago

Just fixed the issue. Apparently I needed to add the Codecov token into python-package.yml.

alec-kr commented 1 year ago

Thank you for making this contribution. 💯

youpong commented 1 year ago

The Dependabot link you sent is broken, and I don't see any security vulnerabilities in the list at the moment. (Quite strange 🤔 )

It might have been a link that only I could see. Here is the link to the relevant CVE. CVE-2022-42969, ReDoS vulnerability