[SNYK MEDIUM]setuptools Regular Expression Denial of Service (due by 10/27/2023)

[pkfec]

Overview

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via crafted HTML package or custom PackageIndex page

https://app.snyk.io/org/fecgov/project/7382e6c8-8f69-4afb-b910-ff61101c54fb#issue-SNYK-PYTHON-SETUPTOOLS-3180412

Introduced through

locust@2.14.2 and pre-commit@2.21.0

Fixed in

setuptools@65.5.1

Completion criteria

• Pin setuptools@65.5.1
• SNYK TEST no longer flags ReDoS vulnerability

[tmpayton]

I'm re-opening this ticket because we are still getting a snyk warning

[tmpayton]

We’ve already upgraded the package listed
setuptools@65.5.1
and when pulling develop and checking locally it shows no vulnerabilities in requirements-dev.txt

steps for testing:

1. git checkout develop
2. pyenv virtualenv (new virtual environment)
3. pyenv activate (new virtual environment)
4. pip install -r requirements.txt && pip install -r requirements-dev.txt
5. snyk test --file=requirements-dev.txt --package-manager=pip (see that there are no errors)
   
6. pip show setuptools(should show version 68.0.0)