Fix zipp DoS vulnerability (Dependabot #3)#27
Conversation
- Update minimum Python version to 3.8.1 in pyproject.toml. - Remove Python 3.7 specific dev dependency versions for pytest, flake8, pytest-cov, and pytest-mock. - Bump jinja2 to ^3.1.6. - Regenerate poetry.lock to remove vulnerable zipp dependency. This resolves Dependabot security alert #3. Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #27 +/- ##
=========================================
Coverage 100.00% 100.00%
=========================================
Files 3 3
Lines 74 74
=========================================
Hits 74 74 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
1 participant
This change addresses the zipp Denial of Service (DoS) vulnerability (Dependabot alert #3) which affected versions < 3.19.1. Since zipp 3.19.1+ requires Python 3.8, I've updated the project's minimum Python version to 3.8.1 and simplified the dev dependencies accordingly. I also took the opportunity to bump jinja2 to a safe version. All tests pass and linting is clean.
PR created automatically by Jules for task 7477253601434467031 started by @esharf