pinecone-io / canopy

Retrieval Augmented Generation (RAG) framework and context engine powered by Pinecone
https://www.pinecone.io/
Apache License 2.0
976 stars 121 forks source link

[Vulnerability] Reporting a security vulnerability due to Gunicorn version being used #350

Open srhrshr opened 1 month ago

srhrshr commented 1 month ago

Is this a new bug?

Current Behavior

Hello!

The latest version of canopy 0.9.0 depends upon the package gunicorn==21.2.0 that is reported to be vulnerable. We would like this to be patched at the earliest for our security and compliance requirements.

Looks like the last package release was in March 2024, so we'd like to see if it's on your roadmap for the next release, or do you think it's better to submit a PR for this ourselves?

Expected Behavior

The fix is to upgrade the gunicorn version to at least 22.0.0.

Steps To Reproduce

N/A

Relevant log output

No response

Environment

N/A

Additional Context

No response