sendgrid-python
sendgrid-python copied to clipboard
fix: Vulnerability fix for starkbank-ecdsa 2.2.0 dependency
Fixes
As part of the quay.io vulnerability report, it is reported that the sendgrid-python==6.11.0 package has a vulnerability (GHSA-9wx7-jrvc-28mm) reported for dependency starkbank-ecdsa==2.2.0 which is the latest version available from 2022 (The starbank repository no longer seems to be maintained).
This PR solves replaces the outdated starbank-ecdsa library (https://github.com/starkbank/ecdsa-python) with an actively mainained library ecdsa (https://github.com/tlsfuzzer/python-ecdsa).
Checklist
- [x] I acknowledge that all my contributions will be made under the project's license
- [X] I have made a material change to the repo (functionality, testing, spelling, grammar)
- [X] I have read the Contribution Guidelines and my PR follows them
- [X] I have titled the PR appropriately
- [X] I have updated my branch with the main branch
- [X] I have added tests that prove my fix is effective or that my feature works
- [X] I have added the necessary documentation about the functionality in the appropriate .md file
- [X] I have added inline documentation to the code I modified