Skip to content

Maintenance: update mako to fix CVE #1523

Closed
@rubenfonseca

Description

@rubenfonseca

Summary

We should update mako dependency to at least 1.2.2.

Why is this needed?

CVE on mako https://nvd.nist.gov/vuln/detail/CVE-2022-40023.

This only affects documentation generation (poetry dev environment). It doesn't impact users of the library.

Which area does this relate to?

No response

Solution

Mako 1.2.2 only supports python >= 3.7. So we should pin mako as a dev dependency and add a note to remove it on v2.

Acknowledgment

Metadata

Metadata

Assignees

No one assigned

    Labels

    internalMaintenance changes

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions