This repository has been archived by the owner on Jan 7, 2024. It is now read-only.
Update pyyaml when 4.2 release is available due to CVE-2017-18342 #52
Assignees
Comments
rmol
added a commit
that referenced
this issue
Apr 12, 2019
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Description
We got a GitHub security alert regarding a CVE in pyyaml: CVE-2017-18342. The fix, merged in the pyyaml repo, renames
safe_loadtoloadandloadtodanger_load.pyyamlis brought in as a development only dependency for this project.We shouldn't update to latest yet due to the fact that the only 4.2* versions available on PyPI are marked as pre-release - see yaml/pyyaml#193 for the full details.
tl;dr We should wait until pyyaml 4.2 is officially released and then update.
The text was updated successfully, but these errors were encountered: