CVE-2021-41945

Advisory

Solana 0.25.0 updates its dependency 'httpx' requirement to '^0.23' to include a security fix.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

Fixed

- Use latest Solders version to make objects pickleable again [(252)](https://github.com/michaelhly/solana-py/pull/252).


Changed

- Updated httpx to fix critical vulnerability [(248)](https://github.com/michaelhly/solana-py/pull/248).
- Updated pytest, websockets, pytest-docker, pytest-asyncio to latest. [(254)](https://github.com/michaelhly/solana-py/pull/254).
- Updated apischema to latest. [(254)](https://github.com/michaelhly/solana-py/pull/254).


Added

- Added `get_latest_blockhash` RPC Call. [(254)](https://github.com/michaelhly/solana-py/pull/254).
- Added `get_fee_for_message` RPC Call. [(254)](https://github.com/michaelhly/solana-py/pull/254).
- Added confirmation strategy which checks if the transaction has exceeded last valid blockheight. [(254)](https://github.com/michaelhly/solana-py/pull/254).
- Added `asyncio_mode = auto` in pytest.ini. [(248)](https://github.com/michaelhly/solana-py/pull/254).
- Added an optional `verify_signature` bool when `transaction.serialize()` is called [(249)](https://github.com/michaelhly/solana-py/pull/249).
- Added Memo program [(249)](https://github.com/michaelhly/solana-py/pull/249).

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41945