ansible / eda-server

Event Driven Ansible for AAP
Apache License 2.0
66 stars 42 forks source link

chore: upgrade deps for CVE's #953

Closed Alex-Izquierdo closed 5 days ago

Alex-Izquierdo commented 3 months ago

Upgrade requests sqlparse pydantic deps to address the following CVE's:

Dostonbek1 commented 3 months ago

Should we upgrade requests in pyproject.toml file too?

Alex-Izquierdo commented 3 months ago

@Dostonbek1

Should we upgrade requests in pyproject.toml file too?

I think as it is now is fine. Requests is a nested dependency so we should rely on the constraints of the dependencies that depends on that.

In our side it is defined just for the test dependencies, so that would not be critical. But even in that case the constraint is a wildcard and seems correct: requests = { version = "*", python = "<4.0" }

sonarcloud[bot] commented 2 months ago

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

sonarcloud[bot] commented 5 days ago

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

Alex-Izquierdo commented 5 days ago

Closed in favor of https://github.com/ansible/eda-server/pull/1075