[bugfix] Updated pyyaml and Jinja2 because of security vulnerabilities

pyyaml: CVE-2017-18342 https://nvd.nist.gov/vuln/detail/CVE-2017-18342 Jinja2: CVE-2019-10906 https://nvd.nist.gov/vuln/detail/CVE-2019-10906
stefanhoelzl · Apr 13, 2019 · b2684c9 · b2684c9
1 parent 6d61e6c
commit b2684c9
Show file tree

Hide file tree

Showing 4 changed files with 6 additions and 5 deletions.
diff --git a/.gitignore b/.gitignore
@@ -1,6 +1,7 @@
 venv
 .idea
 .pytest_cache
+__pycache__
 gh-pages-build
 
 debug

diff --git a/requirements.txt b/requirements.txt
@@ -1,6 +1,6 @@
 Flask==1.0.2
-Jinja2==2.10
-pyyaml==3.13
+Jinja2==2.10.1
+pyyaml==5.1
 docopt==0.6.2
 
 # packaging

diff --git a/setup.py b/setup.py
@@ -40,8 +40,8 @@ def readme():
     ],
     install_requires=[
         'Flask==1.0.2',
-        'Jinja2==2.10',
-        'pyyaml==3.13',
+        'Jinja2==2.10.1',
+        'pyyaml==5.1',
         'docopt==0.6.2',
     ],
     package_data={

diff --git a/vuecli/provider.py b/vuecli/provider.py
@@ -38,7 +38,7 @@ def _load_config(self):
         config_file = Path(self.path, "vuepy.yml")
         if config_file.exists():
             with open(config_file, "r") as fh:
-                config = yaml.load(fh.read())
+                config = yaml.safe_load(fh.read())
             if config:
                 self.config = config