Merge pull request #255 from Stealthii/feature/cveless-networkx

Allow networkx<3 for Python 3.7 or newer
StackStorm · Sep 25, 2023 · 741c181 · 741c181
2 parents 2aab274 + 7dadd4c
commit 741c181
Show file tree

Hide file tree

Showing 2 changed files with 11 additions and 1 deletion.
diff --git a/CHANGELOG.rst b/CHANGELOG.rst
@@ -1,6 +1,15 @@
 Changelog
 =========
 
+In Development
+--------------
+
+Changed
+~~~~~~~
+
+* Update networkx >=2.6 for Python 3.8 to fix insecure deserialization #255 (improvement)
+  Contributed by @Stealthii
+
 1.5.0
 -----
 

diff --git a/requirements.txt b/requirements.txt
@@ -3,7 +3,8 @@ eventlet
 Jinja2>=2.11 # BSD License (3 clause)
 jsonschema!=2.5.0,<3.0.0,>=2.0.0 # MIT
 # networkx v2.6 does not support Python3.6.  Update networkx to match st2
-networkx>=2.5.1,<2.6
+networkx>=2.5.1,<2.6; python_version < '3.7'
+networkx>=2.6,<3; python_version >= '3.7'
 python-dateutil
 PyYAML>=3.1.0 # MIT
 six>=1.9.0