CVE-2022-40897

Advisory

Kglab 0.6.2 updates its dependency 'setuptools' requirement to '>= 65.5.1' to include a security fix.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

2022-11-23

* something is not quite right about source distributions... kudos to <https://stackoverflow.com/questions/608855/excluding-a-top-level-directory-from-a-setuptools-package>
* update `setuptools` to workaround potential vulnerabilities
* create `pyproject.toml` to support upcoming `pip` release
* remove tests and other unnecessary files from source distribution

Resources

• https://pypi.org/project/kglab
• https://pyup.io/changelogs/kglab/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-40897