CVE-2021-21330

Advisory

Pfun 0.12.0 updates the 'aiohttp' dependency to 3.7.4 to avoid an open redirect vulnerability.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

Features
- `pfun.effect` is now implemented in Cython, which greatly improves trampoline interpretation speed
- `pfun.maybe` and `pfun.either` are now both [tagged unions](https://mypy.readthedocs.io/en/stable/literal_types.html#tagged-unions) implemented through `__bool__`, which allows you to narrow the type using `if` statements instead of the more verbose `isinstance`

Fixes
- `aiohttp` dependency version is increased to 3.7.4 to avoid [open redirect vulnerability](https://github.com/advisories/GHSA-v6wp-4m6f-gcjg)

Resources

• https://pypi.org/project/pfun
• https://pyup.io/changelogs/pfun/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21330