Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Dependencies] Remove unused python-jose dependencies from requirements.txt #314

Closed
wants to merge 1 commit into from

Conversation

judysng
Copy link
Contributor

@judysng judysng commented Feb 15, 2024

Changes

  • Removed ecdsa, rsa, and pyasn1 from requirements.txt
  • Added comment to remove those dependencies for if in the future people run pip-compile and those dependencies appear in requirements.txt again

How Has This Been Tested?

Deployed in personal acc, created/deleted cluster

In order to increase the likelihood of your contribution being accepted, please make sure you have read both the Contributing Guidelines and the Project Guidelines

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

Signed-off-by: Judy Ng <njud@amazon.com>
@gmarciani gmarciani added the dependencies Pull requests that update a dependency file label Feb 16, 2024
@@ -26,8 +26,6 @@ click==8.1.3
# via flask
cryptography==42.0.2
# via python-jose
ecdsa==0.18.0
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Every time we will rerun pip-compile, these dependencies will be added again, right?
If this is the case, I don't think it's worth it to remove them and instead simply close the CVE saying that it does not apply

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Also, pyJWT was just approved by security to be used without any need for further approvals.
So at this point we could consider to use it.

@judysng judysng closed this Feb 20, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
dependencies Pull requests that update a dependency file
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants