lava icon indicating copy to clipboard operation
lava copied to clipboard

Update nbconvert version to fix "Mistune v2.0.2 vulnerable to catastrophic backtracking"

Open mgkwill opened this issue 3 years ago • 0 comments

Objective of issue: Update Mistune to v2.0.3 or higher

This is not a high priority, as nbconvert is only used during unit tests of the tutorials, but it should still be fixed.

Mistune is a sub dependency of nbconvert and we are currently at the latest version of nbconvert. When nbconvert releases a new version we can update to it to fix this dependency vulnerability.

https://github.com/lava-nc/lava/security/dependabot/1 Mistune v2.0.2 vulnerable to catastrophic backtracking CVE: CVE-2022-34749

Lava version:

  • [x] 0.4.0

I'm submitting a ...

  • [x] bug report

Update version here: https://github.com/lava-nc/lava/blob/main/pyproject.toml#L55 and run poetry update nbconvert and commit the resulting updates.

mgkwill avatar Aug 05 '22 17:08 mgkwill