lava
lava copied to clipboard
Update nbconvert version to fix "Mistune v2.0.2 vulnerable to catastrophic backtracking"
Objective of issue: Update Mistune to v2.0.3 or higher
This is not a high priority, as nbconvert is only used during unit tests of the tutorials, but it should still be fixed.
Mistune is a sub dependency of nbconvert and we are currently at the latest version of nbconvert. When nbconvert releases a new version we can update to it to fix this dependency vulnerability.
https://github.com/lava-nc/lava/security/dependabot/1 Mistune v2.0.2 vulnerable to catastrophic backtracking CVE: CVE-2022-34749
Lava version:
- [x] 0.4.0
I'm submitting a ...
- [x] bug report
Update version here: https://github.com/lava-nc/lava/blob/main/pyproject.toml#L55 and run poetry update nbconvert and commit the resulting updates.