Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat: fix security warnings in torchft #69

Merged
merged 1 commit into from
Jan 13, 2025
Merged

feat: fix security warnings in torchft #69

merged 1 commit into from
Jan 13, 2025

Conversation

c-p-i-o
Copy link
Contributor

@c-p-i-o c-p-i-o commented Jan 13, 2025

Summary:
Update jinja to address dependabot reported alerts.

  1. Jinja has a sandbox breakout through malicious filename
  2. Jinja has a sandbox breakout through indirect reference to format method.

Test Plan:
Test on github

@c-p-i-o
feat: fix security warnings in torchft
b19f108 
Summary:
Update jinja to address dependabot reported alerts.
1. Jinja has a sandbox breakout through malicious filename
2. Jinja has a sandbox breakout through indirect reference to format
   method.

Test Plan:
Test on github
@c-p-i-o c-p-i-o requested a review from d4l3k January 13, 2025 21:05
@c-p-i-o c-p-i-o self-assigned this Jan 13, 2025
@facebook-github-bot facebook-github-bot added the CLA Signed This label is managed by the Meta Open Source bot. label Jan 13, 2025
d4l3k
d4l3k approved these changes Jan 13, 2025
View reviewed changes
Copy link
Member

@d4l3k d4l3k left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@d4l3k d4l3k merged commit e0f76e1 into main Jan 13, 2025
6 checks passed
@d4l3k d4l3k deleted the cpio/fix_vuln branch January 13, 2025 21:49
@d4l3k
Copy link
Member

d4l3k commented Jan 13, 2025

The security issue here isn't a big deal since it's only during docs generation but thank you for getting rid of the alert :)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@d4l3k d4l3k d4l3k approved these changes

Assignees

@c-p-i-o c-p-i-o

Labels
CLA Signed This label is managed by the Meta Open Source bot.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@c-p-i-o @d4l3k @facebook-github-bot