Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[FEAT]: replace dependency on Retry with a more actively maintained dependency that does not raise CVE-2022-42969 in other platforms #208

Open
1 task done
JosanaDH opened this issue Nov 9, 2023 · 0 comments
Labels
enhancement New feature or request

Comments

@JosanaDH
Copy link

JosanaDH commented Nov 9, 2023

Is there an existing feature request for this?

  • I have searched the existing feature requests

Description

Pysnyk depends on Retry, which has not had a pypi release since 2016.
That release of Retry included a dependency on Py which has had a CVE raised against it (CVE-2022-42969)
Although this has been determined to be a false positive by Snyk (ST-1653) it can still raise queries from customers.

Retry has pushed a fix to master to remove this dependency, but there is no pypi release.

Suggestion is to investigate use of other more actively maintained projects that perform a similar function, such as backoff or tenacity

Additional Information

No response

@JosanaDH JosanaDH added the enhancement New feature or request label Nov 9, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

1 participant