Update requirements.txt

[jmcarpenter2]

Description

I understand that this code is never ran, but my company uses ECR image scanning to identify vulnerabilities and are required to resolve any high or critical severity vulnerabilities within a short period for compliance. As this is in conda, any images containing conda have this vulnerability listed in the image scan. In my case, that is the jupyter/scipy-notebook. Hoping to resolve the issue completely by simply updating the requirement for the test.

https://nvd.nist.gov/vuln/detail/CVE-2023-30861

Switching away from updating flask regularly to using a conda-maintained package with no known security vulnerabilities.

Checklist - did you ...

• Add a file to the news directory (using the template) for the next release's release notes?
• Add / update necessary tests?
• Add / update outdated documentation?
  • As this change doesn't impact functionality, I am not updating documentation

[jmcarpenter2]

@conda-bot check

[conda-bot]

We require contributors to sign our Contributor License Agreement and we don't have one on file for @jmcarpenter2.

In order for us to review and merge your code, please e-sign the Contributor License Agreement PDF. We then need to manually verify your signature, merge the PR (conda/infrastructure#813), and ping the bot to refresh the PR.

[jmcarpenter2]

I have signed the conda CLA now.

[jmcarpenter2]

@conda-bot check

[dholth]

Maybe we can find a fake package to use that will never earn cves. Ken were you using one recently in a test?

…

On Fri, Aug 25, 2023, 4:42 PM Jason Carpenter ***@***.***> wrote: @conda-bot <https://github.com/conda-bot> check — Reply to this email directly, view it on GitHub <#13034 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AABSZERMNLHVKCMOWZ33KELXXEE2RANCNFSM6AAAAAA367NRTU> . You are receiving this because your review was requested.Message ID: ***@***.***>

[jezdez]

@conda-bot check

[jezdez]

Let's change the package that we test for to one of ours and also please add a news file.

[kenodegard]

pre-commit.ci autofix

[jmcarpenter2]

Thanks so much for your help @jezdez, @dholth, and @kenodegard ! Just a quick question to understand: what's the release cycle look like? Just hoping to know when to check back on the vulnerabilities so I can report all clear to my company. Thank you!

[kenodegard]

Conda follows a bi-monthly release schedule, the next release of will occur in September, see CEP-8 for details.

[jmcarpenter2]

Ah great, thanks so much!