search

pytest-dev / pytest-forked

extracted --boxed from pytest-xdist to ensure backward compat
MIT License
62 stars 21 forks source link

py==1.11.0 vulnerability #80

Closed thebaptiste closed 1 year ago

thebaptiste commented 1 year ago

Hello

It would be great to remove the dependency on the py library which is no longer maintained anymore and has security issue :

See https://github.com/pytest-dev/py/issues/287

Regards

webknjaz commented 1 year ago

Who said that it's not maintained? The description there literally says "maintenance mode". Also, can you explain in what way it can realistically be harmful to this plugin?

thebaptiste commented 1 year ago

You are right, I'm wrong, I was misled by this issue on pytest-html This vulnerability on py is most likely not very harmful for the pytest-forked plugin (I had not read all the comments on it) Sorry for the noise, you can close.

nicoddemus commented 1 year ago

Thanks @thebaptiste,

That security vulnerability does not apply to pytest-fork, as it does not use py.svn.

However it is certainly in our interest to remove the dependency to py. :+1: