github version complaints about the gitlab CI requirements.txt

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



So every time I push to my github mirror, github now ends up having a
'dependabot' thing that warns about some of the CI version
requirements for the gitlab automated testing file.

It wants to update the pip requirements from 23.2.1 to 23.3

 - When installing a package from a Mercurial VCS URL, e.g. pip install
   hg+..., with pip prior to v23.3, the specified Mercurial revision
   could be used to inject arbitrary configuration options to the hg
   clone call (e.g. --config). Controlling the Mercurial configuration
   can modify how and which repository is installed. This vulnerability
   does not affect users who aren't installing from Mercurial.

and upgrade the urllib3 requirements from 2.0.4 to 2.0.7:

 - urllib3's request body not stripped after redirect from 303 status
   changes request method to GET

 - `Cookie` HTTP header isn't stripped on cross-origin redirects

And it's not like any of this looks like a big deal, but I'd like to
shut up the messages I get.

I can either just close those issues, or I can apply a patch something
like the attached (which also adds a missing newline at the end).

I thought I should ask the people who actually set this up. Comments?

               Linus
 drivers/gpu/drm/ci/xfails/requirements.txt | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/ci/xfails/requirements.txt b/drivers/gpu/drm/ci/xfails/requirements.txt
index d8856d1581fd..e9994c9db799 100644
--- a/drivers/gpu/drm/ci/xfails/requirements.txt
+++ b/drivers/gpu/drm/ci/xfails/requirements.txt
@@ -5,7 +5,7 @@ termcolor==2.3.0
 certifi==2023.7.22
 charset-normalizer==3.2.0
 idna==3.4
-pip==23.2.1
+pip==23.3
 python-gitlab==3.15.0
 requests==2.31.0
 requests-toolbelt==1.0.0
@@ -13,5 +13,5 @@ ruamel.yaml==0.17.32
 ruamel.yaml.clib==0.2.7
 setuptools==68.0.0
 tenacity==8.2.3
-urllib3==2.0.4
-wheel==0.41.1
\ No newline at end of file
+urllib3==2.0.7
+wheel==0.41.1

[Index of Archives]     [Linux DRI Users]     [Linux Intel Graphics]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]     [XFree86]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Linux Kernel]     [Linux SCSI]     [XFree86]
  Powered by Linux