GHSA-hxwh-jpp2-84pm

[nicolaschaillan]

Hello,

Is there an ETA for fixing GHSA-hxwh-jpp2-84pm ?

GHSA-hxwh-jpp2-84pm

Thank you

[adrianosela]

Opened a PR with a backwards compatible fix (partial fix I guess) in #363

The real fix is a breaking change and requires a new major version - @corydolphin to advise how to deal with this.

[nicolaschaillan]

@corydolphin any update on this please? This is quite urgent or we will need to move to another lib unfortunately

[SaleelAhsanM]

@corydolphin Could you please look into this at your earliest convenience? As this code is currently in production, addressing this issue is quite urgent.

[corydolphin]

Fixed in 4.0.2 and defaulted to False in 5.0.0

[SaleelAhsanM]

5.0.0 is also showing in the Affected versions list.

https://osv.dev/vulnerability/PYSEC-2024-71

[CharlesPerrotMinotHCHB]

Not in the CVE though ; and Github also considers 5.0 to be safe
GHSA-hxwh-jpp2-84pm