Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update development dependency - Twine to v3.2.0 #652

Merged
merged 1 commit into from
Dec 20, 2020

Conversation

PeterDaveHello
Copy link
Contributor

Twine version < 2.0 was reported has a security vulnerability

From Twine version 2.0+, it requires Python 3.6, but doesn't seem to
have other breaking changes.

Reference:

$ safety check --full-report
+==============================================================================+
|                                                                              |
|                               /$$$$$$            /$$                         |
|                              /$$__  $$          | $$                         |
|           /$$$$$$$  /$$$$$$ | $$  \__//$$$$$$  /$$$$$$   /$$   /$$           |
|          /$$_____/ |____  $$| $$$$   /$$__  $$|_  $$_/  | $$  | $$           |
|         |  $$$$$$   /$$$$$$$| $$_/  | $$$$$$$$  | $$    | $$  | $$           |
|          \____  $$ /$$__  $$| $$    | $$_____/  | $$ /$$| $$  | $$           |
|          /$$$$$$$/|  $$$$$$$| $$    |  $$$$$$$  |  $$$$/|  $$$$$$$           |
|         |_______/  \_______/|__/     \_______/   \___/   \____  $$           |
|                                                          /$$  | $$           |
|                                                         |  $$$$$$/           |
|  by pyup.io                                              \______/            |
|                                                                              |
+==============================================================================+
| REPORT                                                                       |
| checked 88 packages, using default DB                                        |
+============================+===========+==========================+==========+
| package                    | installed | affected                 | ID       |
+============================+===========+==========================+==========+
| twine                      | 1.15.0    | <2.0.0                   | 37504    |
+==============================================================================+
| Twine 2.0.0 bumps requests to 2.20 (or later) to avoid reported security     |
| vulnerabilities in earlier releases (bug 491).                               |
+==============================================================================+

Twine version < 2.0 was reported has a security vulnerability

From Twine version 2.0+, it requires Python 3.6, but doesn't seem to
have other breaking changes.

Reference:

- pypa/twine#491
- https://twine.readthedocs.io/en/latest/changelog.html
@ross
Copy link
Contributor

ross commented Dec 20, 2020

I did have things configured to use Dependabot Preview and it would keep on top of this stuff and open monthly PRs to get them updated, https://github.com/octodns/octodns/blob/20d34e08335205fa6e2dd8ac3072c4eca16ea34a/.dependabot/config.yml.

Haven't seen those in a while so guess they must have finished the move over to a native GitHub thing. I haven't looked into that yet https://docs.github.com/en/free-pro-team@latest/github/administering-a-repository/keeping-your-dependencies-updated-automatically. Looks like it may be settings in the repo rather than a (configured) addon now.

Copy link
Contributor

@ross ross left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

| Twine 2.0.0 bumps requests to 2.20 (or later) to avoid reported security |
| vulnerabilities in earlier releases (bug 491). |

Looking at ^ I don't think the twine security vuln would impact octoDNS as it already pulls requests 2.24.0 https://github.com/octodns/octodns/blob/master/requirements.txt#L23

Don't think it'll hurt to update twine though.

@ross ross merged commit 1633af6 into octodns:master Dec 20, 2020
@PeterDaveHello PeterDaveHello deleted the UpdateDevDependency branch December 20, 2020 19:20
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants