fix(sec): upgrade lxml to 4.9.1

Open chncaption opened this issue 3 years ago • 4 comments

There are 1 security vulnerabilities found in lxml 4.5.1

Upgrade lxml from 4.5.1 to 4.9.1 for vulnerability fix

Ideally, no insecure libs should be used.

Nov 28 '22 02:11 chncaption

I had a look into automated solutions. Two exist - also Python modules - but neither can handle the >= in requirements.txt:

safety developers claim to have a release imminent that will address. But until then, manual checks needed.

Nov 28 '22 16:11 ValueRaider

Actually, yfinance doesn't use lxml anymore. Will remove it.

Dec 02 '22 11:12 ValueRaider

Resolved by removing lxml - #1231

Dec 12 '22 22:12 ValueRaider

So removing lxml was wrong. Now restored and minimum version raised. Thanks @chncaption for alerting this problem.

Dec 13 '22 15:12 ValueRaider