[Snyk] Security upgrade werkzeug from 0.10.4 to 3.1.4#58
[Snyk] Security upgrade werkzeug from 0.10.4 to 3.1.4#58
Conversation
The following vulnerabilities are fixed by pinning transitive dependencies: - https://snyk.io/vuln/SNYK-PYTHON-WERKZEUG-14151620
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| traitlets==4.0.0 | ||
| Twisted==15.4.0 | ||
| Werkzeug==0.10.4 | ||
| Werkzeug==3.1.4 |
There was a problem hiding this comment.
Keep Werkzeug version compatible with pinned Flask
Bumping Werkzeug to 3.1.4 while leaving Flask==0.10.1 (line 12 of the same file) creates an incompatible dependency set: Flask 0.10 imports top-level helpers such as werkzeug.import_string and cached_property that were removed in Werkzeug 2.1+, so importing Flask with this new requirement raises ImportError before any app code runs. Unless Flask is upgraded to a version that supports Werkzeug 3.x, this change will break environments that install these requirements and use Flask.
Useful? React with 👍 / 👎.
Snyk has created this PR to fix 1 vulnerabilities in the pip dependencies of this project.
Snyk changed the following file(s):
requirements.txtImportant
Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.
For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic
Learn how to fix vulnerabilities with free interactive lessons:
🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.