Closed
Description
Summary
We should update mako
dependency to at least 1.2.2
.
Why is this needed?
CVE on mako https://nvd.nist.gov/vuln/detail/CVE-2022-40023.
This only affects documentation generation (poetry dev environment). It doesn't impact users of the library.
Which area does this relate to?
No response
Solution
Mako 1.2.2 only supports python >= 3.7. So we should pin mako as a dev dependency and add a note to remove it on v2.
Acknowledgment
- This request meets Lambda Powertools Tenets
- Should this be considered in other Lambda Powertools languages? i.e. Java, TypeScript