[Dependencies] Bump flask version for jinja2 - Githubissues

aws / aws-parallelcluster-ui

Apache License 2.0

31 stars 17 forks source link

[Dependencies] Bump flask version for jinja2 #306

Closed judysng closed 4 months ago

judysng commented 4 months ago

Changes

Updated to flask v2.3.3 because it requires jinja2>3.1.2, which will close CVE-2024-22195
Had to update app.py because JSONEncoder became deprecated as part of flaskv2.3.0, so used DefaultJSONProvider: https://github.com/pallets/flask/pull/4692

How Has This Been Tested?

Deployed stack on personal acc, and created a cluster

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

gmarciani commented 4 months ago

Let's mention in the PR that upgrading jinja to 3.1.3 will also fix CVE-2024-22195