PyYAML vulnerability fix (#171)

* Locking the version of PyYAML to be above 2.1 because of an arbitrary code execution vulnerability. * Addition of a version condition to pyyaml to patch a vulnerability. * Update of Pipfile.lock to match Pipefile.
LLNL · May 28, 2022 · 1a2fd12 · 1a2fd12
1 parent 72c55d9
commit 1a2fd12
Show file tree

Hide file tree

Showing 3 changed files with 52 additions and 89 deletions.
diff --git a/Pipfile b/Pipfile
@@ -9,7 +9,7 @@ filelock = "*"
 six = "*"
 tabulate = "*"
 Fabric = "*"
-PyYAML = "*"
+PyYAML = ">= 4.2b1"
 maestrowf = {path = "."}
 
 [dev-packages]

diff --git a/Pipfile.lock b/Pipfile.lock
diff --git a/setup.py b/setup.py
@@ -16,8 +16,8 @@
                 'maestro = maestrowf.maestro:main',
                 'conductor = maestrowf.conductor:main',
         ]
-    },
-    install_requires=[
+      },
+      install_requires=[
         'PyYAML>=4.2b1',
         'six',
         "filelock",