Skip to content

Upgrade dev dependencies#11

Merged
jamesponddotco merged 2 commits intomainfrom
james.pond/update-dependencies
Jan 17, 2025
Merged

Upgrade dev dependencies#11
jamesponddotco merged 2 commits intomainfrom
james.pond/update-dependencies

Conversation

@jamesponddotco
Copy link
Collaborator

What does this PR do?

Upgrade development dependencies to a security issue with an indirect dependency, virtualenv.

virtualenv before 20.26.6 allows command injection through the activation scripts for a virtual environment. Magic template strings are not quoted correctly when replacing.

Review checklist

Please check relevant items below:

  • The title & description contain a short meaningful summary of work completed.
  • Tests have been updated/created and are passing locally.
  • I've reviewed the CONTRIBUTING.md file.

Signed-off-by: James Pond <james.pond@datadoghq.com>
@jamesponddotco jamesponddotco merged commit b53f997 into main Jan 17, 2025
3 checks passed
@jamesponddotco jamesponddotco deleted the james.pond/update-dependencies branch January 17, 2025 19:15
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants