GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — Bump the cryptography version to 42 · Issue #3950 · feast-dev/feast

Bump the cryptography version to 42 #3950

New issue
Copy link
New issue
Copy link
Closed
#3966
Closed
Bump the cryptography version to 42#3950
#3966
Copy link
Labels
dependenciesPull requests that update a dependency filePull requests that update a dependency file

Description

@brijesh-vora-sp
brijesh-vora-sp
opened on Feb 12, 2024
Issue body actions

Is your feature request related to a problem? Please describe.
cryptography<42 package has some medium vulnerabilities. Example: https://scout.docker.com/vulnerabilities/id/CVE-2023-50782?s=github&n=cryptography&t=pypi&vr=%3C42.0.0&utm_source=desktop&utm_medium=ExternalLink

starlette and fastapi had some high vulnerabilities but that was recently bumped up and thanks to that, they are removed.

Describe the solution you'd like
Bump the cryptography package to>=42. Nice to have: bumping up of other compatible packages also.

Activity

  1. brijesh-vora-sp
    added
    kind/featureNew feature or requestNew feature or request
    on Feb 12, 2024

  2. bushwhackr commented on Feb 15, 2024

    @bushwhackr
    bushwhackr
    on Feb 15, 2024
    Contributor
    More actions

    snowflake-connector-python is blocking the bump https://github.com/snowflakedb/snowflake-connector-python/blob/v3.7.0/setup.cfg#L48

  3. sudohainguyen
    added
    dependenciesPull requests that update a dependency filePull requests that update a dependency file
    and removed
    kind/featureNew feature or requestNew feature or request
    on Feb 16, 2024

  4. sudohainguyen commented on Feb 23, 2024

    @sudohainguyen
    sudohainguyen
    on Feb 23, 2024
    Collaborator
    More actions

    back to this one, since snowflake connector is no longer blocking

    should we set 42 is lower bound for cryptography?
    @bushwhackr @tokoko

  5. tokoko commented on Feb 23, 2024

    @tokoko
    tokoko
    on Feb 23, 2024
    Collaborator
    More actions

    No, I don't think so, let's leave it up for the users. Might get in the way with installing some other packages that people use with feast. snowflake also bumped only the upper bound.

    Reacted by Harry, Chester and Brijesh Vora
  6. franciscojavierarceo
    closed this as completedin #3966on Feb 28, 2024

  7. brijesh-vora-sp commented on Feb 28, 2024

    @brijesh-vora-sp
    brijesh-vora-sp
    on Feb 28, 2024
    ContributorAuthor
    More actions

    Thanks, guys. 👍

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    dependenciesPull requests that update a dependency filePull requests that update a dependency file

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions
      You are visitor 01402503 — GeezerVison does not store the pages you look up.
      Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.