PyYAML vulnerability fix (#171)

* Locking the version of PyYAML to be above 2.1 because of an arbitrary code execution vulnerability. * Addition of a version condition to pyyaml to patch a vulnerability. * Update of Pipfile.lock to match Pipefile.
LLNL · Jul 14, 2019 · e5b6e74 · e5b6e74
1 parent 53e2ba9
commit e5b6e74
Show file tree

Hide file tree

Showing 3 changed files with 51 additions and 88 deletions.
diff --git a/Pipfile b/Pipfile
@@ -9,7 +9,7 @@ filelock = "*"
 six = "*"
 tabulate = "*"
 Fabric = "*"
-PyYAML = "*"
+PyYAML = ">= 4.2b1"
 maestrowf = {path = "."}
 
 [dev-packages]

diff --git a/Pipfile.lock b/Pipfile.lock
diff --git a/setup.py b/setup.py
@@ -16,7 +16,7 @@
         ]
       },
       install_requires=[
-        'PyYAML',
+        'PyYAML>=4.2b1',
         'six',
         'enum34',
         "filelock",