#1409 fix: upgrade request dependency to version that does not use vulnerable py dep Pull request opened by mbuchove fix: upgrade request dependency to version that does not use vulnerable py dep TL;DR This request is just to upgrade the

retry

package dependency in

requirements.txt

for flytekit. The original unmaintained package has a dependency on the

py

package, which has a CVE with no fix version available: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42969 Type ☑︎ Bug Fix ☐ Feature ☐ Plugin Are all requirements met? ☑︎ Code completed ☑︎ Smoke tested ☐ Unit tests added ☐ Code documentation added ☐ Any pending items have an associated Issue Complete description In this PR, it is replaced with the recent release of the

retry2

package version

0.9.5

, which is a fork of the original

retry

package: https://pypi.org/project/retry2/ Tracking Issue flyteorg/flyte#3052 flyteorg/flytekit DCO: DCO ✅ 1 other check has passed 1/2 successful checks