Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Remove dependency on py #60

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Conversation

camara-tech
Copy link

The py library has been marked in maintenance mode, and has a known security vulnerability. https://nvd.nist.gov/vuln/detail/CVE-2022-42969

I successfully ran the tests on python 2.7 and python 3.10 to verify that removing this dependency doesn't require any code changes.

Fixes #58

@tisba
Copy link

tisba commented Jul 11, 2023

Having a known security vulnerability is such a PITA, even if they are not used but just reported by tools 🙄 If you require certain compliance processes, this creates so much unnecessary and annoying work 😞

It would be so awesome, if you could consider merging and releasing this, @invl! 🙏

@robinbowes
Copy link

If py is not used, it seems like a no-brainer to remove the dependency. Would also fix #58

Another vote for this PR 😃

@robinbowes
Copy link

I've done some further investigation.

py contains four tools/modules:

  • py.path: uniform local and svn path objects -> please use pathlib/pathlib2 instead
  • py.apipkg: explicit API control and lazy-importing -> please use the standalone package instead
  • py.iniconfig: easy parsing of .ini files -> please use the standalone package instead
  • py.code: dynamic code generation and introspection (deprecated, moved to pytest as a implementation detail).

Prior to the 1.4 release, it also used to contain py.test which is now its own package, see https://docs.pytest.org

retry only uses py.test, which is now provided by pytest.

It is safe to remove the py dependency.

@CraigKnottAtlassian
Copy link

CraigKnottAtlassian commented Oct 28, 2024

If this works and passes test can a maintainer merge and release this please? @invl

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

retry depends on py but safety is flagging security issues that can't be fixed by bumping py
4 participants