-
Notifications
You must be signed in to change notification settings - Fork 6.6k
chore(deps): update dependency werkzeug to v3.1.4 [security] #13651
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,6 +1,6 @@ | ||
| Flask==3.0.3; python_version > '3.6' | ||
| Flask==2.3.3; python_version < '3.7' | ||
| Werkzeug==3.0.3; python_version > '3.6' | ||
| Werkzeug==2.3.8; python_version < '3.7' | ||
| Werkzeug==3.1.4; python_version > '3.6' | ||
| Werkzeug==3.1.4; python_version < '3.7' | ||
| gunicorn==23.0.0 | ||
| requests[security]==2.31.0 | ||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,5 +1,5 @@ | ||
| Flask==3.0.3; python_version > '3.6' | ||
| Flask==2.3.3; python_version < '3.7' | ||
| Werkzeug==3.0.3; python_version > '3.6' | ||
| Werkzeug==2.3.8; python_version < '3.7' | ||
| Werkzeug==3.1.4; python_version > '3.6' | ||
| Werkzeug==3.1.4; python_version < '3.7' | ||
| gunicorn==23.0.0 |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,6 +1,6 @@ | ||
| Flask==3.0.3; python_version > '3.6' | ||
| Flask==2.3.3; python_version < '3.7' | ||
| Werkzeug==3.0.3; python_version > '3.6' | ||
| Werkzeug==2.3.8; python_version < '3.7' | ||
| Werkzeug==3.1.4; python_version > '3.6' | ||
| Werkzeug==3.1.4; python_version < '3.7' | ||
| gunicorn==23.0.0 | ||
| twilio==9.0.3 |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -3,4 +3,4 @@ Flask-Sockets==0.2.1 | |
| gunicorn==23.0.0 | ||
| requests==2.31.0 | ||
| markupsafe==2.0.1 | ||
| Werkzeug==1.0.1; | ||
| Werkzeug==3.1.4; | ||
|
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. This update to To address the security vulnerability, both |
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,4 +1,4 @@ | ||
| Flask==3.0.3; python_version > '3.6' | ||
| Flask==3.0.3; python_version < '3.7' | ||
| gunicorn==23.0.0 | ||
| Werkzeug==3.0.3 | ||
| Werkzeug==3.1.4 |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,4 +1,4 @@ | ||
| Flask==3.0.3; python_version > '3.6' | ||
| Flask==2.0.3; python_version < '3.7' | ||
| gunicorn==23.0.0 | ||
| Werkzeug==3.0.3 | ||
| Werkzeug==3.1.4 |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,6 +1,6 @@ | ||
| Flask==3.0.3; python_version > '3.6' | ||
| Flask==2.0.3; python_version < '3.7' | ||
| werkzeug==3.0.3; python_version > '3.7' | ||
| werkzeug==2.3.8; python_version <= '3.7' | ||
| werkzeug==3.1.4; python_version > '3.7' | ||
| werkzeug==3.1.4; python_version <= '3.7' | ||
|
Comment on lines
+3
to
+4
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Updating To fix the security vulnerability ( For Python 3.7, |
||
| google-cloud-storage==2.9.0 | ||
| gunicorn==23.0.0 | ||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -2,5 +2,5 @@ Flask==3.0.3; python_version > '3.6' | |
| Flask==2.0.3; python_version < '3.7' | ||
| gunicorn==23.0.0 | ||
| twilio==9.0.3 | ||
| Werkzeug==3.0.3; python_version >= '3.7' | ||
| Werkzeug==2.3.8; python_version < '3.7' | ||
| Werkzeug==3.1.4; python_version >= '3.7' | ||
| Werkzeug==3.1.4; python_version < '3.7' | ||
|
Comment on lines
+5
to
+6
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Updating To correctly address the security vulnerability ( The existing markers seem inconsistent with package requirements. A corrected and secure setup would be as suggested. |
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -3,4 +3,4 @@ Flask-Sockets==0.2.1 | |
| gunicorn==23.0.0 | ||
| requests==2.31.0 | ||
| markupsafe==2.0.1 | ||
| Werkzeug==1.0.1; | ||
| Werkzeug==3.1.4; | ||
|
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. This update to To address the security vulnerability, both |
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,4 +1,4 @@ | ||
| Flask==2.2.2 | ||
| functions-framework==3.9.2 | ||
| google-cloud-documentai==3.0.1 | ||
| Werkzeug==2.3.8 | ||
| Werkzeug==3.1.4 | ||
|
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Updating To fix the security vulnerability ( Note that |
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,4 +1,4 @@ | ||
| Flask==2.2.2 | ||
| functions-framework==3.9.2 | ||
| google-cloud-translate==3.18.0 | ||
| Werkzeug==2.3.8 | ||
| Werkzeug==3.1.4 |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,4 +1,4 @@ | ||
| Flask==2.2.2 | ||
| functions-framework==3.9.2 | ||
| google-cloud-vision==3.8.1 | ||
| Werkzeug==2.3.8 | ||
| Werkzeug==3.1.4 |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,3 +1,3 @@ | ||
| Flask==3.0.3 | ||
| requests==2.31.0 | ||
| Werkzeug==3.0.3 | ||
| Werkzeug==3.1.4 | ||
|
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Updating To fix the security vulnerability ( |
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,2 +1,2 @@ | ||
| Flask==3.0.3 | ||
| Werkzeug==3.0.3 | ||
| Werkzeug==3.1.4 |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -14,5 +14,5 @@ | |
| Flask==3.0.3 | ||
| gunicorn==23.0.0 | ||
| redis==6.0.0 | ||
| Werkzeug==3.0.3 | ||
| Werkzeug==3.1.4 | ||
| # [END memorystore_requirements] | ||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,4 +1,4 @@ | ||
| Flask==3.0.3 | ||
| gunicorn==23.0.0 | ||
| tensorflow==2.12.0 | ||
| Werkzeug==3.0.3 | ||
| Werkzeug==3.1.4 |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -3,4 +3,4 @@ Flask==3.0.3 | |
| earthengine-api==1.5.9 | ||
| gunicorn==23.0.0 | ||
| tensorflow==2.12.0 | ||
| Werkzeug==3.0.3 | ||
| Werkzeug==3.1.4 | ||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -4,4 +4,4 @@ google-cloud-aiplatform==1.47.0 | |
| gunicorn==23.0.0 | ||
| pandas==2.2.3 | ||
| tensorflow==2.12.1 | ||
| Werkzeug==3.0.3 | ||
| Werkzeug==3.1.4 | ||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,6 +1,6 @@ | ||
| Flask==3.0.3 | ||
| gunicorn==23.0.0 | ||
| Werkzeug==3.0.3 | ||
| Werkzeug==3.1.4 | ||
|
|
||
| # Local packages. | ||
| ./weather-data | ||
|
|
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,4 +1,4 @@ | ||
| Flask==3.0.3 | ||
| gunicorn==23.0.0 | ||
| google-cloud-profiler==4.1.0 | ||
| Werkzeug==3.0.3 | ||
| Werkzeug==3.1.4 |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,4 +1,4 @@ | ||
| Flask==3.0.3 | ||
| gunicorn==23.0.0 | ||
| google-cloud-recaptcha-enterprise==1.25.0 | ||
| Werkzeug==3.0.3 | ||
| Werkzeug==3.1.4 |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,6 +1,6 @@ | ||
| selenium==4.10.0 | ||
| Flask==2.2.2 | ||
| Werkzeug==2.3.8 | ||
| Werkzeug==3.1.4 | ||
| pytest==8.2.0 | ||
| pytest-flask==1.2.0 | ||
| webdriver-manager==4.0.2 |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,3 +1,3 @@ | ||
| Flask==3.0.3 | ||
| gunicorn==23.0.0 | ||
| Werkzeug==3.0.3 | ||
| Werkzeug==3.1.4 |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -2,4 +2,4 @@ Flask==3.0.3 | |
| gunicorn==23.0.0 | ||
| google-auth==2.38.0 | ||
| requests==2.31.0 | ||
| Werkzeug==3.0.3 | ||
| Werkzeug==3.1.4 | ||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,4 +1,4 @@ | ||
| Flask==3.0.3 | ||
| pytest==8.2.0 | ||
| gunicorn==23.0.0 | ||
| Werkzeug==3.0.3 | ||
| Werkzeug==3.1.4 |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,4 +1,4 @@ | ||
| Flask==3.0.3 | ||
| opentelemetry-exporter-gcp-trace==1.7.0 | ||
| opentelemetry-propagator-gcp==1.7.0 | ||
| Werkzeug==3.0.3 | ||
| Werkzeug==3.1.4 |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Updating
Werkzeugto3.1.4is problematic as this version requires Python 3.9+. The previous configuration supported older Python versions, and this change would break compatibility for environments using Python < 3.9.To address the security vulnerability (
GHSA-hgf8-39gv-g3f2) while maintaining broader Python version support, I recommend using different versions ofWerkzeugdepending on the Python version. The vulnerability is patched in version3.0.4, which supports Python 3.8+.For Python 3.7,
Werkzeug 2.3.8was used. The security advisory does not list a patch for the 2.3.x series, which implies it might be vulnerable and unpatched. You should consider dropping support for Python 3.7 for this sample if security is a high priority, or accept the risk.A better approach would be to use version-specific dependencies that are secure and compatible.