[Snyk] Security upgrade urllib3 from 2.0.7 to 2.6.3#325
[Snyk] Security upgrade urllib3 from 2.0.7 to 2.6.3#325
Conversation
The following vulnerabilities are fixed by pinning transitive dependencies: - https://snyk.io/vuln/SNYK-PYTHON-URLLIB3-14896210
There was a problem hiding this comment.
Pull request overview
This pull request addresses a security vulnerability in urllib3 by upgrading from version 2.0.7 to 2.6.3. The change explicitly pins urllib3 as a dependency to resolve vulnerability SNYK-PYTHON-URLLIB3-14896210, which was previously an indirect dependency through selenium.
Changes:
- Adds urllib3>=2.6.3 as an explicit dependency with a security comment
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| @@ -1 +1,2 @@ | |||
| selenium | |||
| urllib3>=2.6.3 # not directly required, pinned by Snyk to avoid a vulnerability | |||
There was a problem hiding this comment.
The version constraint uses >= which allows any future version of urllib3 to be installed. This could introduce breaking changes if urllib3 releases a major version update. Consider using a more restrictive constraint like urllib3>=2.6.3,<3.0.0 to prevent potential compatibility issues while still allowing minor version updates within the 2.x series.
| urllib3>=2.6.3 # not directly required, pinned by Snyk to avoid a vulnerability | |
| urllib3>=2.6.3,<3.0.0 # not directly required, pinned by Snyk to avoid a vulnerability |
2 participants
Snyk has created this PR to fix 1 vulnerabilities in the pip dependencies of this project.
Snyk changed the following file(s):
Codechef-Code-Submitter/requirements.txtImportant
Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.
For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic
Learn how to fix vulnerabilities with free interactive lessons:
🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.