bump gitpython because of CVE-2023-40267 #490
Merged
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Gitpython has a vulnerability where it does not block insecure non-multi options in clone and clone_from. This popped up in our vulnerability scanner, so I thought it suggest to bump it.
https://avd.aquasec.com/nvd/2023/cve-2023-40267/
I have a hard time seeing it should pose a real security issue for OPAL users, but who knows. At the very least, it's nice to not get any critical vulnerability reports in vulnerability scanners.
The minor version bump suggest it should be an easy one. Complete changelog here: gitpython-developers/GitPython@3.1.27...3.1.32
Check List (Check all the applicable boxes)
My code follows the code style of this project.My change requires changes to the documentation.I have updated the documentation accordingly.Note to reviewers
I am not sure exactly how to test this further than the automated tests. Let me know if you want further action from my side.
I did not get the tests running on my local machine - would need approval on the test run: https://github.com/permitio/opal/actions/runs/5956379336