-
-
Notifications
You must be signed in to change notification settings - Fork 16
[Snyk] Fix for 3 vulnerabilities #77
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
Conversation
The following vulnerabilities are fixed by pinning transitive dependencies: - https://snyk.io/vuln/SNYK-PYTHON-PROTOBUF-10364902 - https://snyk.io/vuln/SNYK-PYTHON-URLLIB3-10390193 - https://snyk.io/vuln/SNYK-PYTHON-URLLIB3-10390194
Review or Edit in CodeSandboxOpen the branch in Web Editor • VS Code • Insiders |
Reviewer's GuideThe PR leverages Snyk’s automated fix to append two new pinned dependencies in requirements.txt (protobuf and urllib3) at secure versions, ensuring vulnerable transitive packages are upgraded without altering existing direct requirements. Entity relationship diagram for updated pip dependencieserDiagram
REQUIREMENTS_TXT {
string fonttools
string holidays
string zipp
string nltk
string protobuf
string urllib3
}
REQUIREMENTS_TXT ||--o{ PROTOBUF : includes
REQUIREMENTS_TXT ||--o{ URLLIB3 : includes
PROTOBUF {
string version
}
URLLIB3 {
string version
}
Class diagram for requirements.txt dependency structure after Snyk fixclassDiagram
class RequirementsTxt {
+fonttools: string
+holidays: string
+zipp: string
+nltk: string
+protobuf: string
+urllib3: string
}
class Protobuf {
+version: string
}
class Urllib3 {
+version: string
}
RequirementsTxt --> Protobuf : includes
RequirementsTxt --> Urllib3 : includes
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
❌ Deploy Preview for heroic-strudel-239c3c failed.
|
❌ Deploy Preview for joyful-gelato-ff27ed failed.
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM 👍
Snyk has created this PR to fix 3 vulnerabilities in the pip dependencies of this project.
Snyk changed the following file(s):
requirements.txt
Important
Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.
For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic
Learn how to fix vulnerabilities with free interactive lessons:
🦉 Open Redirect
Summary by Sourcery
Pin protobuf and urllib3 versions in requirements.txt to remediate security vulnerabilities
Bug Fixes:
This change is