Repository navigation
Bump the cryptography version to 42 #3950
Description
Is your feature request related to a problem? Please describe.
cryptography<42 package has some medium vulnerabilities. Example: https://scout.docker.com/vulnerabilities/id/CVE-2023-50782?s=github&n=cryptography&t=pypi&vr=%3C42.0.0&utm_source=desktop&utm_medium=ExternalLink
starlette and fastapi had some high vulnerabilities but that was recently bumped up and thanks to that, they are removed.
Describe the solution you'd like
Bump the cryptography package to>=42. Nice to have: bumping up of other compatible packages also.
Activity
bushwhackr commentedon Feb 15, 2024
snowflake-connector-python is blocking the bump https://github.com/snowflakedb/snowflake-connector-python/blob/v3.7.0/setup.cfg#L48
sudohainguyen commentedon Feb 23, 2024
back to this one, since snowflake connector is no longer blocking
should we set 42 is lower bound for
cryptography?@bushwhackr @tokoko
tokoko commentedon Feb 23, 2024
No, I don't think so, let's leave it up for the users. Might get in the way with installing some other packages that people use with feast. snowflake also bumped only the upper bound.
brijesh-vora-sp commentedon Feb 28, 2024
Thanks, guys. 👍