From cb0d03d2d6dd1fb6a11caf8217f44cb31bd4c70b Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 16 Dec 2025 23:04:38 +0000 Subject: [PATCH] deps(dev): bump pyyaml from 5.3 to 6.0.3 Bumps [pyyaml](https://github.com/yaml/pyyaml) from 5.3 to 6.0.3. - [Release notes](https://github.com/yaml/pyyaml/releases) - [Changelog](https://github.com/yaml/pyyaml/blob/6.0.3/CHANGES) - [Commits](https://github.com/yaml/pyyaml/compare/5.3...6.0.3) --- updated-dependencies: - dependency-name: pyyaml dependency-version: 6.0.3 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] --- vulnerable-app/requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/vulnerable-app/requirements.txt b/vulnerable-app/requirements.txt index 2a4d9ce..00e68aa 100644 --- a/vulnerable-app/requirements.txt +++ b/vulnerable-app/requirements.txt @@ -41,7 +41,7 @@ Pillow==8.0.0 # ----------------------------------------------------------------------------- # PyYAML 5.3 has: # - CVE-2020-14343 (Arbitrary Code Execution via yaml.load()) -PyYAML==5.3 +PyYAML==6.0.3 # ----------------------------------------------------------------------------- # HTTP Library - VULNERABLE