Skip to content

Conversation

@hugovk
Copy link
Contributor

@hugovk hugovk commented Oct 6, 2018

Do not merge!

Just a dummy commit to requirements.txt to trigger snyk to see if it reports security problems on the existing pinned requirements.

I suspect they're outdated.

@hugovk
Copy link
Contributor Author

hugovk commented Oct 6, 2018

No, the problem is pre-commit uses PyYAML:

Affected versions of this package are vulnerable to Arbitrary Code Execution due to using the insecure yaml.load() function.

See yaml/pyyaml#74, merged, reverted, being reworked.

@hugovk hugovk closed this Oct 6, 2018
@hugovk hugovk deleted the test-snyk branch October 6, 2018 08:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant