CVE-2022-24065

Advisory

Flytekit 1.1.0 updates its dependency 'cookiecutter' to v2.1.1 to include a security fix.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

* Support for [Optional types](https://github.com/flyteorg/flyte/issues/2426). With the inclusion of Union types in flytekit, we can now support optional types.
* [Flyte Deck](https://github.com/flyteorg/flyte/issues/2175) is now available. Please take a look at the [documentation](https://docs.flyte.org/projects/cookbook/en/latest/auto/core/flyte_basics/deck.html#sphx-glr-auto-core-flyte-basics-deck-py) and also the [OSS presentation](https://www.youtube.com/watch?v=KqyBYIaAZ7c) that was done a few weeks back.
* `pyflyte run` now [supports](https://github.com/flyteorg/flyte/issues/2471) executing tasks.
* `pyflyte register` combines the UX of `run` with the functionality of `package`. Please see the [video](https://www.youtube.com/watch?v=Z_KLl0qhp0Y) posted along with the forthcoming documentation.

Auto Generated
What's Changed
* Skip pip==22.1 by eapolinario in https://github.com/flyteorg/flytekit/pull/997
* FlyteRemote data context does not get used by wild-endeavor in https://github.com/flyteorg/flytekit/pull/993
* Add default list transformer for legacy config by wild-endeavor in https://github.com/flyteorg/flytekit/pull/998
* pyflyte run can now execute a task either locally or remote by kumare3 in https://github.com/flyteorg/flytekit/pull/995
* Allow comma separate packages in pyflyte --pkgs by wild-endeavor in https://github.com/flyteorg/flytekit/pull/999
* Bump plugin pins to 1.1-> 1.2 by wild-endeavor in https://github.com/flyteorg/flytekit/pull/1001
* read packages from environment variables by wild-endeavor in https://github.com/flyteorg/flytekit/pull/1002
* update by wild-endeavor in https://github.com/flyteorg/flytekit/pull/1003
* pass fileaccess data config to data persistence plugin by cosmicBboy in https://github.com/flyteorg/flytekit/pull/1004
* Correctly resolve forwardrefs in namedtuple typing by stef-stripe in https://github.com/flyteorg/flytekit/pull/1005
* Add support deck in jupyter notebook by pingsutw in https://github.com/flyteorg/flytekit/pull/955
* [Snyk] Security upgrade pillow from 9.1.0 to 9.1.1 by EngHabu in https://github.com/flyteorg/flytekit/pull/1012
* Update get_serializable_workflow to consistently generate the same subworkflow order by vvasavada-fn in https://github.com/flyteorg/flytekit/pull/1011
* Fix the tests on windows by pingsutw in https://github.com/flyteorg/flytekit/pull/1013
* Changed 'design' to 'designed' by SmritiSatyanV in https://github.com/flyteorg/flytekit/pull/1010
* Skip config checking if no ini config file present by wild-endeavor in https://github.com/flyteorg/flytekit/pull/1016
* Fix lint error in data.extend.rst by eapolinario in https://github.com/flyteorg/flytekit/pull/1017
* Bump requirements 1653070910 by eapolinario in https://github.com/flyteorg/flytekit/pull/1014
* Fix importing code in script mode by eapolinario in https://github.com/flyteorg/flytekit/pull/1021
* Use interface instead of python_interface to support remote entities in imperative by wild-endeavor in https://github.com/flyteorg/flytekit/pull/1000
* pyflyte register by wild-endeavor in https://github.com/flyteorg/flytekit/pull/1019
* Added support for insecureSkipVerify on pyflyte by RobertoRRW in https://github.com/flyteorg/flytekit/pull/1020
* Allow struct/dataclass types to be used as default arguments by RobertoRRW in https://github.com/flyteorg/flytekit/pull/1024
* Adding owner by wild-endeavor in https://github.com/flyteorg/flytekit/pull/1029
* Add task_id field to ExecutionParameters by wild-endeavor in https://github.com/flyteorg/flytekit/pull/1022
* TypeTransformer for Numpy by samhita-alla in https://github.com/flyteorg/flytekit/pull/1027
* Bump githb codecov action to 1.5.2 by eapolinario in https://github.com/flyteorg/flytekit/pull/1031
* Do not deserialize default list/dict inputs using JSON in `pyflyte run` by samhita-alla in https://github.com/flyteorg/flytekit/pull/1033
* Allow using underscores and numeric in the image name by pingsutw in https://github.com/flyteorg/flytekit/pull/1030
* Bump codecov gh action and pin plugins requirements in tests by eapolinario in https://github.com/flyteorg/flytekit/pull/1026
* Fix wrong version help string in `pyflyte register` by fg91 in https://github.com/flyteorg/flytekit/pull/1056
* Add deck_uri to NodeExecution by pingsutw in https://github.com/flyteorg/flytekit/pull/1034
* Add support list of flytetype in dataclass by pingsutw in https://github.com/flyteorg/flytekit/pull/1057
* [Snyk] Security upgrade cookiecutter from 1.7.3 to 2.1.1 by eapolinario in https://github.com/flyteorg/flytekit/pull/1054
* Bump cookiecutter from 1.7.3 to 2.1.1 in /tests/flytekit/integration/remote/mock_flyte_repo/workflows by dependabot in https://github.com/flyteorg/flytekit/pull/1058
* Bump flyteidl and other requirements by eapolinario in https://github.com/flyteorg/flytekit/pull/1060
* Fix get client in flyte-cli commands by eapolinario in https://github.com/flyteorg/flytekit/pull/1063
* Fix port rewrite in the case of sandbox/demo cluster by eapolinario in https://github.com/flyteorg/flytekit/pull/1064
* Add polars plugin by RobinKa in https://github.com/flyteorg/flytekit/pull/1061
* Fix read authorization_metadata_key from public_client_config in _refresh_credentials_from_command by sonjaer in https://github.com/flyteorg/flytekit/pull/1065
* Fix serialization of tasks with environment variables set by jeevb in https://github.com/flyteorg/flytekit/pull/1066
* Add support union type for pyflyte run by pingsutw in https://github.com/flyteorg/flytekit/pull/1062
* Support optional input by pingsutw in https://github.com/flyteorg/flytekit/pull/989
* Ignore extension when attempting to read yaml config by wild-endeavor in https://github.com/flyteorg/flytekit/pull/1075
* Unit tests for promise.py by pingsutw in https://github.com/flyteorg/flytekit/pull/1076
* Fixed doc for cron schedule by pmahindrakar-oss in https://github.com/flyteorg/flytekit/pull/1081
* Return deck html string when calling get_deck() by pingsutw in https://github.com/flyteorg/flytekit/pull/1074
* Add details on fsspec data plugin by SmritiSatyanV in https://github.com/flyteorg/flytekit/pull/1082
* Bump grpcio to 1.47.0 by pingsutw in https://github.com/flyteorg/flytekit/pull/1077
* Remove html tags in README markdown by cosmicBboy in https://github.com/flyteorg/flytekit/pull/1083
* Add support insert in SQLAlchemyTask by pingsutw in https://github.com/flyteorg/flytekit/pull/1070
* Add importlib-metadata to setup.py by wild-endeavor in https://github.com/flyteorg/flytekit/pull/1086

New Contributors!!
* stef-stripe made their first contribution in https://github.com/flyteorg/flytekit/pull/1005
* vvasavada-fn made their first contribution in https://github.com/flyteorg/flytekit/pull/1011
* RobertoRRW made their first contribution in https://github.com/flyteorg/flytekit/pull/1020
* fg91 made their first contribution in https://github.com/flyteorg/flytekit/pull/1056
* RobinKa made their first contribution in https://github.com/flyteorg/flytekit/pull/1061

**Full Changelog**: https://github.com/flyteorg/flytekit/compare/v1.0.2...v1.1.0

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24065