[Snyk] Security upgrade werkzeug from 2.2.3 to 3.1.5 #11
Conversation
The following vulnerabilities are fixed by pinning transitive dependencies: - https://snyk.io/vuln/SNYK-PYTHON-WERKZEUG-14908843
There was a problem hiding this comment.
Pull request overview
This PR upgrades Werkzeug from version 2.2.3 to 3.1.5 to fix a security vulnerability (SNYK-PYTHON-WERKZEUG-14908843). This is a major version upgrade that addresses critical security issues but introduces breaking changes.
Changes:
- Added Werkzeug version constraint (>=3.1.5) to requirements.txt to resolve security vulnerability
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| tox | ||
| celery[redis]>=5.0.0 | ||
| gunicorn | ||
| werkzeug>=3.1.5 # not directly required, pinned by Snyk to avoid a vulnerability |
There was a problem hiding this comment.
This upgrade from Werkzeug 2.2.3 to 3.1.5 is a major version change (2.x to 3.x) that includes breaking changes. The warning messages in the PR description indicate that Flask 2.2.5 and Flask-JWT-Extended 4.6.0 both require Werkzeug but may not be compatible with version 3.x. To ensure compatibility, you should:
- Pin Flask to a version that supports Werkzeug 3.x (Flask >= 3.0.0 supports Werkzeug 3.x)
- Pin Flask-JWT-Extended to a compatible version (check compatibility with both Flask 3.x and Werkzeug 3.x)
- Test all Flask-related functionality thoroughly after this upgrade
Without explicit version constraints for Flask and its extensions, pip may install incompatible versions that could break the application at runtime.
| tox | ||
| celery[redis]>=5.0.0 | ||
| gunicorn | ||
| werkzeug>=3.1.5 # not directly required, pinned by Snyk to avoid a vulnerability |
There was a problem hiding this comment.
The use of '>=' operator for Werkzeug allows future versions beyond 3.1.5, which could introduce additional breaking changes or compatibility issues. For critical security fixes, consider using a more restrictive constraint like 'werkzeug>=3.1.5,<4.0.0' to stay within the 3.x series while still receiving patch updates, or pin to a specific version range to avoid unexpected breaking changes in future major versions.
| werkzeug>=3.1.5 # not directly required, pinned by Snyk to avoid a vulnerability | |
| werkzeug>=3.1.5,<4.0.0 # not directly required, pinned by Snyk to avoid a vulnerability |
Snyk has created this PR to fix 1 vulnerabilities in the pip dependencies of this project.
Snyk changed the following file(s):
proj/requirements.txtImportant
Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.
For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic
Learn how to fix vulnerabilities with free interactive lessons:
🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.