Skip to content

Commit 1c27748

Browse files
author
Kubudak90
committed
fix: bump web3 upper bound to allow security fix GHSA-5hr4-253g-cpx2
The web3 dependency pin (<=7.10.0) was blocking the security fix for SSRF via CCIP Read (GHSA-5hr4-253g-cpx2) which shipped in web3==7.15.0. This change updates the constraint from: web3>=7.6.0,<=7.10.0 to: web3>=7.6.0,<8.0.0 Allowing users to install the patched web3 version while maintaining compatibility with the existing API. Fixes #636
1 parent 21512f9 commit 1c27748

1 file changed

Lines changed: 1 addition & 1 deletion

File tree

python/pyproject.toml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ dependencies = [
1414
"urllib3>=2.2.3",
1515
"aiohttp>=3.11.16",
1616
"aiohttp-retry>=2.9.1",
17-
"web3>=7.6.0,<=7.10.0",
17+
"web3>=7.6.0,<8.0.0",
1818
"solana>=0.36.6",
1919
"solders>=0.26.0",
2020
"nest-asyncio>=1.6.0,<2",

0 commit comments

Comments
 (0)