From ee98b084af02eb8d0f5068486267fec853836aa7 Mon Sep 17 00:00:00 2001 From: snyk-bot Date: Mon, 13 Sep 2021 16:47:51 +0000 Subject: [PATCH 1/2] fix: requirements.txt to reduce vulnerabilities The following vulnerabilities are fixed by pinning transitive dependencies: - https://snyk.io/vuln/SNYK-PYTHON-SQLPARSE-1584201 - https://snyk.io/vuln/SNYK-PYTHON-THRIFT-474615 --- requirements.txt | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/requirements.txt b/requirements.txt index cc07c7bdb..67648bd4a 100644 --- a/requirements.txt +++ b/requirements.txt @@ -2,4 +2,5 @@ dbt-core==0.20.0rc2 PyHive[hive]>=0.6.0,<0.7.0 pyodbc>=4.0.30 sqlparams>=3.0.0 -thrift>=0.11.0,<0.12.0 +thrift>=0.13.0,<0.12.0 +sqlparse>=0.4.2 # not directly required, pinned by Snyk to avoid a vulnerability From 8cda649bd163ba08160a96cfd47068392a69f923 Mon Sep 17 00:00:00 2001 From: leahwicz <60146280+leahwicz@users.noreply.github.com> Date: Tue, 14 Sep 2021 09:42:58 -0400 Subject: [PATCH 2/2] Removing Thrift conflict with versions over 12 --- requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/requirements.txt b/requirements.txt index 67648bd4a..6e306e56f 100644 --- a/requirements.txt +++ b/requirements.txt @@ -2,5 +2,5 @@ dbt-core==0.20.0rc2 PyHive[hive]>=0.6.0,<0.7.0 pyodbc>=4.0.30 sqlparams>=3.0.0 -thrift>=0.13.0,<0.12.0 +thrift>=0.13.0 sqlparse>=0.4.2 # not directly required, pinned by Snyk to avoid a vulnerability