Conversation
The following vulnerabilities are fixed by pinning transitive dependencies: - https://snyk.io/vuln/SNYK-PYTHON-URLLIB3-14192442 - https://snyk.io/vuln/SNYK-PYTHON-URLLIB3-14192443
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| urllib3==2.6.0 | ||
| requests==2.27.1;python_version<"3.6" | ||
| requests==2.27.1;python_version>="3.6" and python_version<"3.7" | ||
| requests==2.28.1;python_version>="3.7" |
There was a problem hiding this comment.
Avoid incompatible urllib3 upgrade with pinned requests
Upgrading urllib3 to 2.6.0 while leaving requests pinned to 2.27.1/2.28.1 introduces a hard dependency conflict: both those requests releases declare urllib3<1.27, so the resolver will refuse this requirements set and installs will fail for all Python versions covered here. Please align the urllib3 pin with the constraints of the pinned requests versions or bump requests to a release that supports urllib3 2.x.
Useful? React with 👍 / 👎.
Snyk has created this PR to fix 2 vulnerabilities in the pip dependencies of this project.
Snyk changed the following file(s):
requirements.txtImportant
Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.
For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic
Learn how to fix vulnerabilities with free interactive lessons:
🦉 Allocation of Resources Without Limits or Throttling