search

dropbox / dropbox-sdk-python

The Official Dropbox API V2 SDK for Python
https://www.dropbox.com/developers
MIT License
930 stars 318 forks source link

requests is pinned to <2.30, but requests prior to 2.32 is subject to CVE-2024-35195 #504

Closed SamStephens closed 2 months ago

SamStephens commented 2 months ago

Describe the issue

Requests was pinned to <2.30 by a commit that does not explain why that pin was introduced. Requests prior to 2.32 is subject to CVE-2024-35195.

What is the path to getting the dropbox client back to tracking the latest version of requests?

SamStephens commented 2 months ago

Also CVE-2023-32681.

maxbelanger commented 2 months ago

Thanks for reporting this! A fix is available in v12.0.1.