Allow PyYAML 5.4.x #5887
Merged
Allow PyYAML 5.4.x #5887
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
shivaylamba
approved these changes
Feb 7, 2021
|
@dcarley can you fix merge conflicts |
PyYAML 5.4 was released a couple of days ago with a fix for: - https://ubuntu.com/security/CVE-2020-14343 - yaml/pyyaml#420 - https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation The changes otherwise appear to be backwards compatible: - https://github.com/yaml/pyyaml/blob/5.4.1/CHANGES Being able to use a later version is important for companies that have automatic dependency scanning for CVEs.
dcarley
force-pushed
the
dcarley/pyyaml54
branch
from
8a59a03 to
a62b73b
Compare
Sure, rebased against |
Closed
Closed
14 tasks
|
What is the ETA for the PR merge and package release to pypi? |
8 tasks
|
Hi @dcarley @shivaylamba, PyYAML 5.3.1 (the version currently required by awscli) has a 9.6 CVVS vulnerability: https://snyk.io/vuln/SNYK-PYTHON-PYYAML-590151 Thank you! |
|
Hi everyone, Just to clarify, the CLI is not impacted by this CVE. We only use the |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description of changes:
PyYAML 5.4 was released a couple of days ago with a fix for:
The changes otherwise appear to be backwards compatible:
Being able to use a later version is important for companies that have
automatic dependency scanning for CVEs.
Issue #, if available:
N/A
By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.