Vulnerable Dependency

Pinned dependency version is affected by a published remote code execution advisory.

A crafted YAML payload processed by the pinned library version can execute arbitrary code on the server.

Upgrade to a patched release and pin the minimum safe version in the lockfile.

test_dependency_audit_has_no_known_cves

def test_dependency_audit_has_no_known_cves():
    report = pip_audit("requirements.txt")
    assert report.critical == 0 and report.high == 0