Conversation
|
Having a known security vulnerability is such a PITA, even if they are not used but just reported by tools 🙄 If you require certain compliance processes, this creates so much unnecessary and annoying work 😞 It would be so awesome, if you could consider merging and releasing this, @invl! 🙏 |
|
If py is not used, it seems like a no-brainer to remove the dependency. Would also fix #58 Another vote for this PR 😃 |
|
I've done some further investigation. py contains four tools/modules:
Prior to the 1.4 release, it also used to contain py.test which is now its own package, see https://docs.pytest.org retry only uses py.test, which is now provided by It is safe to remove the |
|
If this works and passes test can a maintainer merge and release this please? @invl |
The
pylibrary has been marked in maintenance mode, and has a known security vulnerability. https://nvd.nist.gov/vuln/detail/CVE-2022-42969I successfully ran the tests on python 2.7 and python 3.10 to verify that removing this dependency doesn't require any code changes.
Fixes #58