-
Notifications
You must be signed in to change notification settings - Fork 26
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Fix security vulnerability by specifying a secure requests version. #72
Conversation
Hello @Michionlion! I am writing to let you know that GitHub flagged a security problem in GatorGrader because of the fact that the tool is transitively depending on the There is already an issue about this, but it was closed and I do not understand the comments well enough to see how to re-configure Travis CI. Here is the reference: pypa/pipenv#3247. I should also point out that this might be an active bug for which a fix is in the works, according to pypa/pipenv#3265. Finally, I'm wondering whether or not this would be an issue for the Gradle plugin and its installation of GatorGrader's dependencies through |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Everything looks good! I tested this by doing a quick modification of GatorGradle to pull down this branch and install it (using git clone --branch more-secure-pip <url> <folder>
instead of the normal command without --branch <name>
), and everything worked great. It doesn't look like there are any issues, and if the CI passes now, this PR should be okay to merge!
Thanks for merging @Michionlion! |
No description provided.