-
Notifications
You must be signed in to change notification settings - Fork 10
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Upgrade Pymongo throughout to resolve security notifications in dependabot #188
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This PR doesn't seem to address the source of the outdated Pymongo, which is a very old version of motor within the common module.
I propose we instead upgrade that, instead of adding an additional dependency on pymongo
everywhere.
@adrianclay Both the setup.py and Pipfile within the common module request motor 3.5.1 which is the latest tag of the repo you linked to and and the latest version here: https://pypi.org/project/motor/ |
In that case I wouldn't bother with trying to fix the Dependabot alert. It appears to be only relevant when connecting to an untrusted Mongo server. |
What
Please include a summary of the changes and the related issue
Why
Please include details of the reasoning for these changes
Type of change
Please delete options that are not relevant.
Checklist: