Skip to content

Fix security vulnerabilities in dependencies#15

Open
ZechCodes wants to merge 1 commit intomainfrom
fix/security-vulnerabilities
Open

Fix security vulnerabilities in dependencies#15
ZechCodes wants to merge 1 commit intomainfrom
fix/security-vulnerabilities

Conversation

@ZechCodes
Copy link
Owner

Summary

  • Fix CVE-2024-21503 (Medium severity): Black ReDoS vulnerability by updating from 23.12.1 to 24.10.0
  • Fix high severity ReDoS vulnerability in py library by updating pytest from 6.2.5 to 8.4.0 (removes py dependency completely)
  • Update other dependencies for security patches including certifi, urllib3, requests

Security Fixes

Black (CVE-2024-21503)

  • Issue: Regular Expression Denial of Service when processing malicious input with many leading tab characters
  • Fix: Updated to Black 24.10.0 which includes the security patch
  • Impact: Low risk since Black is a development tool

py Library (High Severity)

  • Issue: ReDoS vulnerability when used with subversion
  • Fix: Updated pytest to 8.4.0 which no longer depends on the vulnerable py library
  • Impact: Completely eliminates the vulnerability by removing the dependency

Test Results

✅ All 140 tests pass with updated dependencies
✅ No breaking changes detected
✅ Dependency tree cleaned up (py library removed entirely)

Dependencies Updated

  • black: 23.12.1 → 24.10.0
  • pytest: 6.2.5 → 8.4.0
  • py library: Removed (no longer needed)
  • Various other security patches applied

🤖 Generated with Claude Code

- Update Black from 23.12.1 to 24.10.0 (fixes CVE-2024-21503 ReDoS vulnerability)
- Update pytest from 6.2.5 to 8.4.0 (removes vulnerable py library dependency)
- Remove py library completely (no longer needed by newer pytest)
- Update other dependencies for security patches

All tests pass with updated dependencies.

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant

Comments