Merge pull request #8047 from cms-sw/smuzaffar-patch-5

nbconvert vulnerable to cross-site scripting (XSS)
cms-sw · Aug 29, 2022 · fe3377d · fe3377d
2 parents 1738bce + 22ef8c5
commit fe3377d
Show file tree

Hide file tree

Showing 3 changed files with 4 additions and 1 deletion.
diff --git a/pip/nbconvert.file b/pip/nbconvert.file
@@ -1,2 +1,3 @@
 Requires: py3-Jinja2 py3-Pygments py3-bleach py3-defusedxml py3-entrypoints py3-mistune py3-pandocfilters py3-nbformat
 Requires: py3-testpath py3-jupyterlab-pygments py3-nbclient
+Requires: py3-beautifulsoup4 py3-lxml py3-tinycss2
diff --git a/pip/requirements.txt b/pip/requirements.txt
@@ -163,7 +163,7 @@ mpmath==1.2.1
 msgpack==1.0.3
 multidict==5.1.0
 nbclient==0.5.4
-nbconvert==6.1.0
+nbconvert==6.5.1
 #nbdime==3.1.0 ; disabled not used by cmssw
 nbformat==5.1.3
 nest-asyncio==1.5.1
@@ -292,6 +292,7 @@ testpath==0.5.0
 #NO_AUTO_UPDATE: Below is a dummy test package to show how to use custom download command to download a package source.
 test-download==7.44.1
 Theano==1.0.5
+tinycss2==1.1.1
 toml==0.10.2
 tomli==1.2.1
 tomlkit==0.7.2

diff --git a/pip/tinycss2.file b/pip/tinycss2.file
@@ -0,0 +1 @@
+Requires: py3-flit-core py3-webencodings