ormar icon indicating copy to clipboard operation
ormar copied to clipboard

Allow Pydantic 1.10.13 to mitigate security risk

Open kokroo opened this issue 1 year ago • 0 comments

A new CVE was published (link), in which Pydantic versions below 1.10.13 have a denial of service vulnerability.

Switching to that version causes this:

The conflict is caused by:
    The user requested pydantic>=1.10.13
    ormar 0.12.2 depends on pydantic!=1.7, !=1.7.1, !=1.7.2, !=1.7.3, !=1.8, !=1.8.1, <1.10.9 and >=1.6.1

I think Ormar 0.12.2 will work just fine with Pydantic 1.10.13, and it's a minor version bump and I think Ormar has an automated test suite anyway. We should release a new Ormar minor version, probably 0.12.3, which allows Pydantic 1.10.13 because not everyone can switch to Ormar 2.0.0 right now.

@collerek I think this is urgent since it's a security issue in one of Ormar's dependencies itself.

kokroo avatar May 11 '24 20:05 kokroo